CRACK PASSWORD LOGIN FORM USE HYDRA & BURPSUITE

CRACK PASSWORD LOGIN FORM USE HYDRA & BURPSUITE


Hi everyone, in this article I will show you how to crack login password using Hydra and Burpsuite (KALI LINUX). The purpose of guidance for penetration testing is to be conducted on an individual laboratory. Therefore, I am not responsible for bad behaviors carried out outside the laboratory by your actions.
Step 1: Open THC-Hydra
So, let's get started. Fire up Kali and open THC-Hydra from Applications -> Kali Linux -> Password Attacks -> Online Attacks -> hydra.

Step 2: Get the Web Form Parameters
To be able to hack web form usernames and passwords, we need to determine the parameters of the web form login page as well as how the form responds to bad/failed logins. The key parameters we must identify are the:
1.IP Address of the website
2.URL
3.type of form
4.field containing the username
5.field containing the password
6.failure message


Step 3: Using Burp Suite
Although we can use any proxy to do the job, including Tamper Data, in this post we will use Burp Suite. You can open Burp Suite by going to Applications -> Kali Linux -> Web Applications -> Web Application Proxies -> burpsuite. When you do, you should see the opening screen like below.

Next, we will be attempting to crack the password on the Damn Vulnerable Web Application (DVWA). You can run it from the Metasploitable operating system (available at Rapid7) and then connecting to its login page, as I have here.

We need to enable the Proxy and Intercept on the Burp Suite like I have below. Make sure to click on the Proxy tab at the top and then Intercept on the second row of tabs. Make certain that the "Intercept is on.


"

Last, we need to configure our IceWeasel web browser to use a proxy. We can go to Edit -> Preferences -> Advanced -> Network -> Settings to open the Connection Settings, as seen below. There, configure IceWeasel to use 127.0.0.1 port 8080 as a proxy by typing in 127.0.0.1 in the HTTP Proxy field, 8080 in the Port field and delete any information in the No Proxy for field at the bottom. Also, select the "Use this proxy server for all protocols" button.

Step 4: Get the Bad Login Response
Now, let's try to log in with my username OTW and password OTW. When I do so, the BurpSuite intercepts the request and shows us the key fields we need for a THC-Hydra web form crack.

After collecting this information, I then forward the request from Burp Suite by hitting the "Forward" button to the far left . The DVWA returns a message that the "Login failed." Now, I have all the information I need to configure THC-Hydra to crack this web app!

Getting the failure message is key to getting THC-Hydra to work on web forms. In this case, it is a text-based message, but it won't always be. At times it may be a cookie, but the critical part is finding out how the application communicates a failed login. In this way, we can tell THC-Hydra to keep trying different passwords; only when that message does not appear, have we succeeded.


Step 5: Place the Parameters into Your THC Hydra Command
Now, that we have the parameters, we can place them into the THC-Hydra command. The syntax looks like this:



kali$ hydra -L -p

So, based on the information we have gathered from Burp Suite, our command should look something like this:



kali $ hydra -L -P 192.168.1.101 http-post-form "/dvwa/login.php:username=^USER^&password=^PASS^&Login=Login:Login failed"



A few things to note. First, you use the upper case "L" if you are using a username list and a lower case "l" if you are trying to crack one username that you supply there. In this case, I will be using the lower case "l " as I will only be trying to crack the "admin" password. After the address of the login form (/dvwa/login.php), the next field is the name of the field that takes the username. In our case, it is "username," but on some forms it might be something different, such as "login." Now, let's put together a command that will crack this web form login.


Step 6: Choose a Wordlist
Now, we need to chose a wordlist. As with any dictionary attack, the wordlist is key. You can use a custom one made with Crunch of CeWL, but Kali has numerous wordlists built right in. To see them all, simply type



kali $ locate wordlist



In addition, there are numerous online sites with wordlists that can be up to 100 GB! Choose wisely, my hacker novitiates. In this case, I will be using a built-in wordlist with less than 1,000 words at:
/usr/share/dirb/wordlists/short.txt



Step 7: Build the Command



kali > hydra -l admin -P /usr/share/dirb/wordlists/small.txt 192.168.1.101 http-post-form "/dvwa/login.php:username=^USER^&password=^PASS^&Login=Login:Login failed" -V



1. -l indicates a single username (use -L for a username list)
2. -P indicates use the following password list
3. http-post-form indicates the type of form
4. /dvwa/login-php is the login page URL
5. username is the form field where the username is entered
6. ^USER^ tells Hydra to use the username or list in the field
7. password is the form field where the password is entered (it may be passwd, pass, etc.)
8. ^PASS^ tells Hydra to use the password list supplied
9. Login indicates to Hydra the login failed message
10. Login failed is the login failure message that the form returned
11. -V is for verbose output showing every attempt



Step 8 : Run
Now, let her fly! Since we used the -V switch, THC-Hydra will show us every attempt.

After a few minutes, Hydra returns with the password for our web application. Success!

So I showed you how to crack passwords using Hydra & Burpsuite, this is just moottj among many ways. If you do not understand how Burpsuite works, please find the article about "how to use Burpsuit" on my site. Cài đặt bài đăng Nhãn Được xuất bản vào 10:19 08/11/2019 Pacific Standard Time Liên kết cố định Vị trí Tùy chọn