As you can see, I have Wireshark opened up in the background and I'm going to go ahead and run
Hydra real quick. And you can see, boom, it creates a ton of traffic behind the scenes.
But with that, and let me go ahead and stop Wireshark real quick. As I zoom in for you,
you can see that we have a success as far as Hydra being able to identify what password was
working on the bwap.test site. So 80 HTTP posts form in blue, bwap.test, login as B and bug.
Now I did modify the john.list for the password files to include bug. Otherwise it would have
gone into the actual brute forcing of it. And it would have taken maybe a day or two to be able to
do this because it's having to go through and then do the permutations of the guessing. But
we're saving time here. So with this, we went through and also saw that it created a lot of
traffic because it tried all those attempts really quick. Now, fun fact that inside of the skill
itself, right below this video, I have an output from Wireshark that includes this kind of capture
for our bwap.test running Hydra. So you can see how fast this actually ran in real time.
And along with the amount of traffic that it did create. I point all that out because you can
actually append the Hydra command with T and W for how many threads are ran at once and the actual
wait time for it as well in seconds. So let's say that I come out again and I'm going to start up
Wireshark one more time. And I'm going to push up on the command and this time just add a dash T
of four and a dash W of 15. Now I'll run it. You can see that it's still generating a lot of
traffic, but not as quick. So that way network defenders and cybersecurity technicians won't
be suspicious as to what's going on. This is still a little bit too fast for what normal network
traffic is to expect because a lot of what's being captured in Wireshark is HTTP post and
a lot of attempts from the same IP address over and over within a very short period.