OK, guys, so we went over, met this boy and actually doing setting off some boys and using metastable
to break into systems, but there are other ways to do it as well.
In what ways?
A brute force attack.
So you don't always have to use the exploit you.
Like I was saying, you can pretty much brute force you into the system.
And it's exactly what it sounds like.
You know, when you launch a brute force attack, you continuously just trying to log into a specific
account or at least accounts kind of depends on how you set it up.
And you usually have a large password, a file, and you just keep going.
And so you get access and it typically works against systems.
They use weak passwords and trust me, a lot of systems passwords or have the default passwords.
So it's typically going to work better against those systems.
And like, if you know something about like, you know, how many characters the password is or what
the structure is, that makes it a lot easier as well.
So a good tool for brute force is actually got to hydrate.
So Hydra is a program and cause on Linux by default, and it's going to allow you to launch some brute
force attacks.
And the typical syntax for it is as follows.
So he's going to Hydra, that's command dash L and S username dash P, the list you're going to link
over to a wordlist file and then you put the IP address that you're targeting and then also the login
with it.
So like an example is Hijau Dash L Route P world is that t t the target address and then ECES H.
So this is going to attempt to brute force that IP address over s h for the root account using each
password inside of this wordlist that we have right there.
So this is pretty much how Hydra works.
So let's actually go ahead and check this out.
OK, guys, so back in our colonics machine, so let's go ahead and check out how to use hydrous.
So as I said before, the command for Hijaz does Hijrah and a dash L and then you would just do whatever
username you wanted to do.
So in this case, we could try like Envisat admin and then we wanted to dash PEV to a list.
So let's say I have a word list.
So actually I'm going to do that right now just so that we have this word lists.
And just to be safe, I'm not sure what directory you are in the work directory.
Did you set list?
Perfect.
OK, so I'm going to change to that directory.
So let's see so that I can rouverol quick CD Sutcliffe's and then I'm going to create a new file.
So just like passwords and then let's see.
So we want to make like a quick pastoralist's.
So there's only ones available that I'm going to show you in a moment.
But just to show you how I do works.
So let's see, let's just try like sumos or password.
Password once you three.
Um, I don't know, I an administrator and then let's put em in at the bottom just because we know this
password.
But the point is, you're going to have a wordlist list that's going to have a lot of different passwords
in it and it's going to go through each one of them and try to brute force into the account.
So let's do it right quick on this.
Uh, so now we can go back over here.
So let's do our hijau come in.
So just to confirm as well, just do it last and we see our passwords file that we created, so.
Let me see, we are going to do Hijrah Dash l unless you have an.
The SPI passwords, and then we're going to do targets one at zero one six eight one zero one six eight.
The five six one zero four SDH is never going to enter and see what happens.
So now is going through and is brute forcing and hey said we found Love You and Mr. MSF Admin and the
password is MSF admin.
So it does it pretty quickly.
Even if you have like a gigantic like wordlist, actually you can do it pretty quickly.
It's pretty useful, pretty handy tool for brute force.
It just to show you guys really quickly, there is a folder or there is a GitHub repository that I recommend
that you closed down so I can actually show you it over here.
So if you just go to Google and type in sexless GitHub, so I'm right here.
But you guys grab this, you are your GitHub dot com.
See, we can just grab that and then you could do a get Kalanchoe in and.
Just clone that repository, and that's what that's the folder that I'm in right now, so you can go
in and clone that.
And what it is, is a bunch of, like, lists of different username, username lists, password list
and stuff.
So if you wanted to get passwords, we can change over passwords.
I would do a list and see what's in here.
And it's a bunch of text files with all kinds of passwords inside of it.
So it's pretty useful.
These are like common credentials, you know, lists of passwords from breaches, you know, typical
things that you're going to find.
And you'll be surprised that a lot of people use these common passwords.
So it's definitely these are gigantic lists, too.
So you can use these when you're doing your ethical hacking and it might actually be able to get you
access into some systems.
So if we wanted to, we could use one of these passwords, password lists for this for this Haja thing
as well.
But, you know, if we're trying to break in for the MSF admin account, we can maybe put in one of
these as the pastoralists.
So I just wanted to point that out.
And then, like I said before, it also has a bunch of, like, username lists as well.
So you can see the user names.
As to and enlistee different username lists and stuff like that, so definitely a useful repository
and I recommend that if you're going to do any brute force in that, you have these lists available
to you.