WEBVTT 00:00:03.040 --> 00:00:08.770 Hi, and welcome to Credential Access‑Brute Force with THC Hydra. 00:00:09.340 --> 00:00:10.450 My name is Lee Allen. 00:00:10.940 --> 00:00:11.670 In this course, 00:00:11.680 --> 00:00:15.210 you will be presented with a quick overview and 00:00:15.210 --> 00:00:19.570 demonstrations of how you can leverage THC Hydra towards 00:00:19.570 --> 00:00:22.870 identifying the usage of weak passwords. 00:00:25.540 --> 00:00:29.770 THC Hydra was created by Van Houser back in 2001, 00:00:30.640 --> 00:00:33.870 and he has continually updated Hydra, throughout the years. 00:00:33.870 --> 00:00:38.470 The tool can be used towards brute forcing of network logins. 00:00:39.040 --> 00:00:43.570 It is a powerful and fast parallel password cracking tool with a 00:00:43.570 --> 00:00:46.660 wide variety of supported network protocols, 00:00:46.670 --> 00:00:50.260 which include, but are not limited to, SSH, 00:00:50.270 --> 00:00:58.260 HTTP, RDP, MySQL, Microsoft SQL, and so many more. 00:00:58.840 --> 00:01:05.069 Basically, if it can be reached over the network and requires credentials, 00:01:05.440 --> 00:01:09.250 there is a good likelihood that Hydra will be able to assist. 00:01:09.940 --> 00:01:15.450 Hydra is open sourced and licensed under the GNU of Pharaoh 00:01:15.460 --> 00:01:19.200 General Public License and is available for download and 00:01:19.200 --> 00:01:26.100 compilation at github.com/vanhouser‑thc/thc‑hydra. 00:01:26.100 --> 00:01:31.000 The tool has support for most platforms, 00:01:31.010 --> 00:01:35.030 including MacOS, Windows with Cygwin, Solaris, 00:01:35.030 --> 00:01:41.080 FreeBSD, and Linux, and even mobile installs that are based on QNX, Linux, 00:01:41.080 --> 00:01:42.070 or MacOS. 00:01:43.140 --> 00:01:46.170 The demonstrations in this course will take advantage of the 00:01:46.170 --> 00:01:49.230 pre‑installed version that comes available on Kali. 00:01:50.340 --> 00:01:54.410 If you take a look at a kill chain, you will find that THC Hydra, 00:01:54.420 --> 00:01:56.960 which is a brute‑force network login cracker, 00:01:57.640 --> 00:02:02.860 will typically be used somewhere in between reconnaissance and lateral movement. 00:02:03.340 --> 00:02:05.510 For instance, during your engagement, 00:02:05.520 --> 00:02:08.820 you may come across a network device or a website that 00:02:08.820 --> 00:02:11.950 requires a username and password credential set. 00:02:12.540 --> 00:02:16.300 Hydra can then be used to guess valid credential pairs. 00:02:16.940 --> 00:02:21.100 As you gain more access into the target network or application, 00:02:21.110 --> 00:02:24.530 you may have other opportunities to use the brute forcing 00:02:24.530 --> 00:02:26.870 capabilities that Hydra makes available to you. 00:02:28.740 --> 00:02:32.500 MITRE has put together a wonderful knowledge base known as the MITRE 00:02:32.500 --> 00:02:37.300 ATT&CK framework that details and categorizes the different tactics that 00:02:37.300 --> 00:02:40.350 they've seen attackers use in real world attacks. 00:02:42.040 --> 00:02:47.560 Within the credential access tactic, you'll find technique T1110 Brute Force. 00:02:48.040 --> 00:02:51.430 THC Hydra is a very specialized tool that is good 00:02:51.430 --> 00:02:52.840 at brute forcing network logons. 00:02:53.220 --> 00:02:56.530 Keep in mind that brute forcing is typically used when other, 00:02:56.530 --> 00:03:00.250 less intrusive and noisy alternatives are not an option. 00:03:00.740 --> 00:03:04.660 There are three sub‑techniques that apply directly to Hydra's capabilities, 00:03:04.830 --> 00:03:10.260 the first of which is T1110.001 Password Guessing. 00:03:10.530 --> 00:03:14.750 This involves making logon attempts until valid credential sets are found. 00:03:15.140 --> 00:03:18.440 This could be done with a password list or iterating through 00:03:18.440 --> 00:03:20.570 character sets until you get a valid match. 00:03:21.440 --> 00:03:26.570 T1110.003 involves password spraying. 00:03:26.940 --> 00:03:30.790 Password spraying involves looping a couple of likely passwords, 00:03:30.800 --> 00:03:35.400 such as winter 2020 around a very large list of usernames. 00:03:35.540 --> 00:03:37.870 This can then help an attacker reduce the chance of 00:03:37.880 --> 00:03:39.870 accidentally getting locked out of accounts. 00:03:40.240 --> 00:03:43.660 And the third sub‑technique is known as credential stuffing. 00:03:44.040 --> 00:03:47.230 An attacker will grab a credential set that has been leaked and 00:03:47.230 --> 00:03:50.840 then attempt to find other services that allow you to log in 00:03:50.850 --> 00:03:52.860 using those very same credentials. 00:03:53.340 --> 00:03:57.740 This has a high likelihood of working if the user has been reusing the 00:03:57.740 --> 00:04:00.960 same username and password combo for several services. 00:04:01.540 --> 00:04:04.820 Let's take a look at an environment so that we can see the attack path 00:04:04.830 --> 00:04:07.150 that someone might need to take when using Hydra. 00:04:08.240 --> 00:04:11.580 As an attacker or defender in hopes of identifying the 00:04:11.580 --> 00:04:14.450 usage of weak or commonly used passwords, 00:04:14.840 --> 00:04:18.579 you could potentially come from the inside of the network or, 00:04:18.810 --> 00:04:20.850 as in this case, from the outside. 00:04:21.339 --> 00:04:24.820 Usually your reconnaissance effort will have already been completed, 00:04:24.830 --> 00:04:27.550 and they'll provide you with some information about the target. 00:04:27.940 --> 00:04:28.930 Using Hydra, 00:04:28.940 --> 00:04:31.820 you will then be able to make attempts at brute forcing any 00:04:31.820 --> 00:04:34.570 externally exposed login opportunities. 00:04:35.240 --> 00:04:38.840 This could be any of the many network services that Hydra supports, 00:04:38.850 --> 00:04:42.470 such as VPN, email servers, websites, and so on.