Welcome to Part Five of this module.
It's time to take out our trusty mirrors shields and gaze for a while at Medusa Medusa is a lightweight
log in brute force her that is to password cracking what a tribute Shay is to a castle Medusa is often
seen as the also rans the much more popular Hydra however will Hydra is undeniably superior for attacking
individual web portals.
Medusa is efficient for most everything else it is speedy and modular although it requires a lot of
user input but it's not that difficult to use.
Once you get past the excessive number of switches Medusa comes bundled with Kali 2.0 and is a linux
only offering at least right now.
It can be found under applications password attacks Medusa running it on the command line without other
inputs.
Gives us our help menu with all the switches.
For those of you who have been following along this course in order you will have already seen most
of what Medusa can do.
Done by Hydra in other modules such as for example.
We looked at Sparta that being said this is a solid program.
So why would you use it over Hydra.
Medusa is a very lightweight tool.
It is a much cleaner log cracker and it is multi threaded which allows you to scan multiple hosts at
one time.
The great thing about this is that it works on many services such as FTE P H TTP my sequel telnet and
many others will Hydra tends to be integrated into a lot of things such as burp sweet and Sparta Medusa
is not a tool that you should ignore in this video.
The target is once again going to be a metal splinter able to machine that I have running on the office
network never use this or any other hacking tool against any target that you do not personally own or
have written permission from the owner to penetration test or you could be breaking the law.
Let's get started.
I should begin by saying that I cheated a little bit here and created a word list that contains the
correct usernames and passwords for our target along with a few incorrect ones.
This is because I want to teach the method and using a full sized word list would achieve the same objective
but it would take hours or even days.
I've said it before and other modules and it's worth repeating brute forcing is normally a very long
and very slow process if you choose this approach.
You need to be prepared to dedicate the system that you're using to the task for an undetermined length
of time.
It's hard in your system and you want to make certain whatever device you have for cooling your computer
be it a fan or something else is operational since your processor can really heat up if you're wondering
about word lists.
Please see the prior video on cool and on crunch for instructions on how to create word lists of your
own.
You can also use the ones that come prepackaged with Kelly 2.0 such as the excellent rock you would
list and if all else fails you can download lists from many different sources online.
But with all of that being said a list of some kind is in fact required with Medusa.
It will not work like John the Ripper does.
If you don't supply one so for services like F T.P. telnet SSA.
This is a fantastic tool.
Let's go over some of the key commands tech H is how we specify our target hostname or IP address.
The next command that we're going to be using is the TAC U which specifies the user name.
This isn't always necessary though as there are many cases where you won't have a user name.
It's possible to use a user name list along with a password list which will be demonstrated in the next
example.
It's also worth pointing out that the TAC uppercase H is used to specify a file containing a list of
hosts if you just came from the information gathering section of this course you might have just such
a file in a text document.
And like I said this is where Medusa really shines because it's quite good at scanning multiple targets.
It seems like so many penetration testers just rely on Hydra and totally overlook this very nice aspect
of Medusa and by the same token we can use the TAC uppercase U to specify a file containing user names.
Just imagine having a list of hosts obtained during the information gathering phase.
Then a list of user names obtained through sequel map or some other method she may not be the most beautiful
girl at the ball but Medusa is a fantastic dancer the tech P option is how we will specify our password
file and the tech uppercase M which is short for module allows us to specify the service that we will
be attacking.
Whereas the TAC n allows us to specify a port.
So our first command is going to be against the SSA H port on our target.
All we need is the U.R.L. or the IP address which you may remember from prior videos as being 10 dot
0 0 dot eight.
The cracking process is slightly different because we have to specify a few things.
So to launch the attack type Medusa and we're going to specify TAC H for the host which is 10 dot 0
0 dot 8 and now we're going to specify a user name with tak you and we're going to give it MSF admin
which is the user name for the IMET a splitter BL machine that we're going to be attacking again.
I'll demonstrate how to use a list for this in the next example.
Next we're going to use uppercase P and we're going to specify the location of the word list that we're
going to be using for password guesses.
Now in this case it is located on my desktop and again you can use the word lists that came with Cally
such as Rocky U or even generate your own.
If you were doing this blind against a real target I would recommend either rock you or sequel map word
lists
Tak capital M is used to specify the module which in this case is SS H then we use the TAC n command
to give it a port which is twenty two by default for SS H connections everything appears to be an order.
So we press enter this will be over very quickly because as I said I cheated and I put the passwords
into a word list that I'm using.
This process goes off like a normal brute force attack and then as a word list attack by default it
goes through all of the words and all of the combinations that can go through and it successfully obtained
both passwords.
Great.
Now let's try this again against a different service.
Let's pretend that we don't have the user name.
This time we're going to specify a user name file which again is going to be quite short because I cheated
and we're going to attack the FTB service running on Port 21.
Just clear the screen there so the command is almost exactly the same as before.
Give it the target.
We're not going to specify a user name this time we're going to use capital you and we're going to give
it our word list which is going to be desktop user lists.
I stored my user list on the desktop and of course yours would be wherever you stored it.
Then we'll use Tak P to specify the file we're using for password guesses which is still word list and
then tack m sorry and this time we're going to specify that the attack is against F.
And finally we're going to give it the port and for TPA the default port is 21 and I'm sorry.
And this is case sensitive desktop needed to have a capital D.
All right.
Sorry about that little typos
so here we are specifying the target host the location of the user list which in my case again was on
the desktop.
The location of the word list to be used for password guesses.
The service which is FCP and the port which is 21 by default.
Now Medusa is going to go through all possible combinations using these very simple and short lists
and I'm going to let this run for a while so that you can see exactly how this process is working as
we go.
You're going to see successes announced in the read out but in the case of a very large pen test these
can be somewhat hard to spot the procedure is basically the same for any service that you wish to attack
simply specify the correct service using TAC uppercase M and the correct port and watch Medusa go or
supply a target list and leave Medusa to do her thing at the start of this video.
I mention that Medusa is modular and there are in fact a lot of modules that have been written to expand
and build upon Medusa has considerable capabilities and these can be found online.
Medusa is an open source tool and while it doesn't get the kind of love and attention that Hydra often
receives it does have a loyal following.
It really isn't possible to show off the true potential of Medusa just using the few computers I have
at my disposal but its capability at going through a large number of targets is really quite impressive
so keep this in mind when you're doing large scale penetration tests and also keep in mind that even
though brute forcing is as I've said it over and over painfully slow Medusa is very efficient at it.
Provided that you give it a good word list to utilize and a good word list would be one that is either
tailored for your target or a wordless.
That does not contain a lot of duplicate words or nonsense strings that would only clutter up this process.
All right.
And so scrolling up here we can see that there were several successes Amidst the many many guesses
and that was Medusa an excellent tool that I hope will be of use to you.
Thank you.