We've seen where we can identify multiple types of hashes,
either on an individual or in a multiple file level.
We can even send it to programs like John
and have it guess and brute force a password
or work itself through a word list,
all sorts of different things.
Well, now it's time to take this show on the road,
quite literally, to go onto the network
and be able to use all the tools that we have
in one wrapped up pretty bow called Hydra.
And Hydra is basically a John the Ripper for us,
but from remote and allows us to be able to attack
multiple different types of web applications.
Now, Hydra comes with pros and cons, right?
The pro is, is that you could actually use Hydra
to identify a whole word list of passwords
and usernames as well to go through
and run against a particular web application,
FTP, anything that's on the network essentially, right?
And it will go through and do it,
but it's incredibly noisy.
And by that, I'm gonna be showing you
some demonstrations here in a second.
But Hydra is a little wonky on the syntax
and we will be walking through that as well too.
I'm gonna be giving you an example
because as diverse as it is for being able
to work on passwords with network devices,
you gotta be perfect in your syntax.
And we'll walk through an example
and kind of point you in the right direction
and just know an entire course could be taught on Hydra.
We're tying all this up in a fifth of the skills
as just an introduction.
We'll definitely be coming back to it
later on in the course.
So don't you worry.
So let's do it to it real quick on the side screen.
Now, Hydra is a command line tool that we use.
And there's a couple of different things
we can break down out of this already.
I have an example set up
and we're gonna be using it against our BWAP,
Windows 10 lab that we have here in the Adept.
So we start off with Hydra in the dash L.
I want to identify that that lowercase L
is identifying that we're using one username.
If it was an uppercase L,
like I have in the little chart below,
that you could actually point it to a list of usernames
like we do have the actual passwords below
or on there as well.
So lowercase L, one username, uppercase L list.
And that's why the uppercase P is a list
and the lowercase B would be one single password.
So you have a username and a password
that you have to use in combination with each other
to be able to try against the actual application itself.
Can you use this against websites
that only require a password?
Yes, and that comes into the actual next part of this
because you see that we have the actual target,
bwap.test and followed by HTTP post form.
Well, this is two-parter.
One is our target and two is the type of attack
that we're doing with Hydra.
In this particular instance, we're using HTTP post
because we gathered some information
about the website already.
Where you may ask, I'm glad you did ask.
We actually got it from our good old buddy Burp Suite.
And how we know is because inside of a packet capture
when we ran it against the bwap site
and picked up this packet
when somebody was trying to log in to the bwap.
If I zoom in here for you,
you can see up at line one post, bwap login.php.
So that tells you that this is a HTTP post
into a form of the actual page itself that it's going to
because we never saw it in the actual address bar.
Well, using tools like bwap or even Wireshark,
which we'll use here in just a moment
can show you the full path of where it's actually going,
even though it may be masked inside the browser.
Now on line 16, inside of our actual Burp Suite here,
you can see that I have highlighted the login equal B
and at ampersand password equal ASTF, blah, blah, blah.
Now that's not the real username password.
I put that in there just to be able to capture a packet
to see how it's submitted to beyond the actual login page.
This information right here is critical
into the next part of Hydra
because if you're doing an HTTP post form configuration
like so, you will need the fields
to know where the information is supposed to go
for that username and or password single user list.
So you can see there in the quotation marks
slash bwap slash login.php,
which is where the pages is that we're going against, right?
That's the one we're attacking.
Colon, login equal,
and this is the information you got from line 16 as well
at the very end where the login
was where we inputted our users.
So caret user caret is coming from the list of user
or that single input ampersand.
Password is the other fillable
for the password on that page as well.
So this could change.
It could be user pass.
It could be box one, box two.
This is just something you'll have to be able
to identify using tools like Burp Suite
or a HTML inspector on the actual browser itself
like view source.
And so equal caret pass caret
and then ampersand form equal submit.
And that's where the actual button was pressed
or the command was sent to be able to send the data
to the actual authentication side of that website.
And again, picked up from the actual Burp Suite.
Colon, and this right here,
if you'll notice there's three parts of this.
The first is where, the second is what with,
and the third is how.
And this is the how section.
And this is identified by either a success or failure.
So how does Hydra know what the information it used
was either good or bad in its attempt to be able
to brute force or crack the password
for that web application.
And in this particular instance,
we have a capital S meaning success.
So when we get a trigger,
this particular trigger will tell us
whether it's successful or not.
And that trigger is equaling slash bwap slash portal.php.
Now, what is that?
Well, after you log in and bwap.test would be in bug,
you go to, you are directed to bwap.test slash bwap
slash portal.php, meaning you've made it to the login page.
So I know that we're successful in our attempt
to crack this password with our word list
if I make it to that page.
And isn't that the full link?
No, but that's the appending of bwap.test.
So our host is always going to stay the same
at bwap.test.
Now, again, I'm very kind of skipping the pond with this
because there's so many different things
as you probably picked up on already
that could be changed in Hydra.
And as we continue the course,
Hydra will be expanded upon
and used in different situations.
And lastly, dash pv because it's very verbose
and I like more information being sent to me
while this is ran.