WEBVTT 00:00:01.140 --> 00:00:02.400 All right, before we get started, 00:00:02.400 --> 00:00:05.200 you should know that this lab and demonstration 00:00:05.200 --> 00:00:07.690 required the use of four virtual machines. 00:00:08.240 --> 00:00:11.720 We have a Windows 2016 server running Active Directory, 00:00:11.940 --> 00:00:16.149 which is pre‑configured with a long list of Globomantics users. 00:00:16.840 --> 00:00:19.650 There is also a Windows 10 client that has been 00:00:19.650 --> 00:00:21.400 added to the Globomantics domain. 00:00:21.940 --> 00:00:26.250 This will become our target when brute forcing RDP, or Remote Desktop. 00:00:26.840 --> 00:00:30.760 In addition, the lab also includes bee‑box version 1.6, 00:00:31.090 --> 00:00:34.090 which gives us a nice target for the HTTP login 00:00:34.210 --> 00:00:39.580 cracking attempts in the form of bWAPP, which is an intentionally vulnerable, 00:00:39.900 --> 00:00:41.470 extremely buggy web app. 00:00:41.480 --> 00:00:45.050 And it's really good for learning about web application security issues. 00:00:45.340 --> 00:00:49.940 And then we have Kali Linux 2019, which comes with THC Hydra 00:00:49.940 --> 00:00:52.750 pre‑installed and is used to launch all of the brute force 00:00:52.750 --> 00:00:54.370 attacks within the demonstration. 00:00:54.650 --> 00:00:57.480 And one last thing. During this demonstration, two files are 00:00:57.480 --> 00:00:59.350 used to perform the brute force attacks. 00:00:59.740 --> 00:01:02.120 One is named usernames.txt, 00:01:02.130 --> 00:01:05.280 and it contains a long list of usernames that have been pulled 00:01:05.280 --> 00:01:09.380 from the Active Directory domain in the target environment. And 00:01:09.380 --> 00:01:11.900 the other file is named passwords.txt, 00:01:11.950 --> 00:01:15.560 and it contains a short listing of passwords that are targeted at the 00:01:15.560 --> 00:01:18.750 environment that we're testing. In a real‑life situation, you would 00:01:18.760 --> 00:01:22.660 leverage downloadable password lists or create your own password 00:01:22.660 --> 00:01:24.450 lists using specialized tools. 00:01:26.140 --> 00:01:29.300 Now that we've reviewed where Hydra fits into the big picture, 00:01:29.840 --> 00:01:33.500 we are going to jump into a demonstration where you will learn the 00:01:33.500 --> 00:01:37.030 basics of Hydra, brute forcing a website login, 00:01:38.090 --> 00:01:40.380 combining a list of usernames with a list of 00:01:41.050 --> 00:01:44.080 passwords, resuming an interrupted session, 00:01:44.410 --> 00:01:49.950 looping passwords around users, targeting RDP, using a proxy, 00:01:50.590 --> 00:01:53.780 and leveraging debug to identify problems. 00:01:57.140 --> 00:02:01.710 We are going to start off on the Kali Linux machine I've got set up 00:02:01.710 --> 00:02:05.300 here in the lab, and I'm going to go to the Terminal Emulator and 00:02:05.300 --> 00:02:08.039 then take a look at the man page for Hydra. 00:02:09.340 --> 00:02:13.090 And what I really wanted to highlight here is the section down 00:02:13.090 --> 00:02:18.000 towards the bottom, Currently this tool supports. And then look at 00:02:18.000 --> 00:02:21.430 that list. We've got FTP, and SSH, and SIP, 00:02:22.740 --> 00:02:24.090 and the list just goes on. 00:02:24.100 --> 00:02:28.430 So if you're facing a situation to where you need to brute force a 00:02:28.430 --> 00:02:33.560 credential set, make sure that you take a look at this list and see if the 00:02:33.560 --> 00:02:36.680 service that you want to target is supported by Hydra. 00:02:36.740 --> 00:02:41.450 And then you may want to take a look at this section down here 00:02:42.140 --> 00:02:45.900 where it says OPTIONAL SERVICE PARAMETERS. Some modules have 00:02:45.910 --> 00:02:47.890 optional or mandatory options. 00:02:48.060 --> 00:02:53.120 Type hydra ‑ U space servicename. For our first demonstration, 00:02:53.120 --> 00:02:57.550 we're going to take a look at http‑post.form. 00:02:57.940 --> 00:03:04.050 So let's exit out of the man page here and then hydra ‑U 00:03:04.640 --> 00:03:09.610 http‑post‑form. I'm going to scroll up here a bit. 00:03:09.730 --> 00:03:12.680 So the ‑U section will give you some information 00:03:12.690 --> 00:03:14.660 about the module that you're using. 00:03:15.170 --> 00:03:19.340 In this case, you have the syntax and a description, 00:03:19.420 --> 00:03:23.040 and this will help you make sure that you collect all of the required 00:03:23.040 --> 00:03:26.470 information that you need when attempting a brute force attempt. 00:03:26.540 --> 00:03:30.770 So let's go ahead and bounce out of the Terminal Emulator 00:03:30.770 --> 00:03:33.550 here and take a look at our target. 00:03:33.640 --> 00:03:38.150 In this case, I'm going to open the Web Browser, and I've got a bWAPP, 00:03:38.920 --> 00:03:42.750 extremely buggy web app, running, and it has a login form. 00:03:43.440 --> 00:03:47.290 We are going to attempt to brute force this credential set. 00:03:47.330 --> 00:03:51.270 So, let's go ahead and type in bee, and then I'm going to 00:03:51.270 --> 00:03:54.450 type in password and see what happens. 00:03:56.400 --> 00:03:58.590 As you can imagine, it did not let me log in. 00:03:58.890 --> 00:04:01.580 But one thing of note here is if you look at the bottom, 00:04:01.580 --> 00:04:04.380 you've got invalid credentials or user not activated. 00:04:04.840 --> 00:04:06.780 That's important because that is something that you're 00:04:06.780 --> 00:04:09.510 going to need for the HTTP POST form. 00:04:09.800 --> 00:04:15.460 Let's go ahead and look under the hood here, and I'll Ctrl+Shift+E for the 00:04:15.460 --> 00:04:22.170 developer tools and then reload that page, resend the information, and then 00:04:22.170 --> 00:04:27.720 I'm going to scroll up here. In order to make things a bit more readable, I'm 00:04:27.720 --> 00:04:34.850 going to click Edit and Resend and then scroll down. In the Request Body 00:04:35.740 --> 00:04:37.810 we've got this piece right here. 00:04:37.980 --> 00:04:40.240 This is super important for what we're attempting to do. 00:04:40.940 --> 00:04:49.270 So I'm going to copy it as it is and then minimize the web browser. I'm going 00:04:49.270 --> 00:04:54.750 to jump over back into the terminal and clear the screen.