KNOX D3: Brute Force

Creating custom username list & wordlist for bruteforciing.

<div dir="ltr" style="text-align: left;" trbidi="on"><div style="text-align: left;">During brute-forcing every time you need custom  password list & username list. Username list is as well as important as password list, it should be unique for every organization.If we use traditional large number of username list , then it will be tedious process.Custom username list also useful in <a href="http://tipstrickshack.blogspot.com/2013/11/username-enumeration-in-mutillidae.html">username enumeration</a>.</div><h3 style="text-align: left;">Creating custom username list:-</h3><div style="text-align: left;"><br />(1)<a href="https://github.com/pentestgeek/jigsaw" target="_blank">Jigsaw</a>:-</div><br />During <a href="http://tipstrickshack.blogspot.com/search/label/Information%20Gathering">information gathering</a> stage , you may use jigsaw script. It is great script for gathering employees `s details like fullname, position, department, email addresses.You should use script with your jigsaw credential.<br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEieuLcSrq_SLhtQUOn72-6n19VbUtv_ORxyT1rOqTYkj5G9Oj7oB8yVHdvhgrLHOylbaLRhuXmrwhkwxgq33NmKk7Xoduk_QDjLdKbNAterHLqL2hr42aNO3zfXSPJ7bMZY_tlNeMRid8cJ/s1600/jigsaw.PNG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="99" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEieuLcSrq_SLhtQUOn72-6n19VbUtv_ORxyT1rOqTYkj5G9Oj7oB8yVHdvhgrLHOylbaLRhuXmrwhkwxgq33NmKk7Xoduk_QDjLdKbNAterHLqL2hr42aNO3zfXSPJ7bMZY_tlNeMRid8cJ/s320/jigsaw.PNG" width="320" /></a></div><br />some times email address`s initial can be username of employee.So you can get different username from output of jigsaw script.<br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhILb8exFjNJxHwZ7qIKjt1NNigKYM9AiUYUvNns3j4YqZFWh0z6kwqwY2Sl-rJPZYV7vQLMY3rd6SsD7XrhyJ3V5FSXjhNR7aOhOCowrVE5rm2pSivIec9Uftd0-lgbbwFbywOJtLoSOaP/s1600/jigsaw-3.PNG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="180" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhILb8exFjNJxHwZ7qIKjt1NNigKYM9AiUYUvNns3j4YqZFWh0z6kwqwY2Sl-rJPZYV7vQLMY3rd6SsD7XrhyJ3V5FSXjhNR7aOhOCowrVE5rm2pSivIec9Uftd0-lgbbwFbywOJtLoSOaP/s320/jigsaw-3.PNG" width="320" /></a></div><br />(2)Username script:-<br /><br />If you have full name of users then you can use <a href="http://blog.techorganic.com/2011/07/creating-user-name-list-for-brute-force.html">username.py</a> script to generate possible username by using different combination of first name & last name.<br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjGN6OvcE1Ppy_QysMKMjSKp1JFgKm0N58i1yqkRsRzEmOjdK5d-SR_lh4K_P9nRZwDt8dK20FwB74gPw4gIkAe8N4Q-XteKpbma71d0uM7ySFaYSXBQmHnNjMqGcoEniHAwxk1d0_qs_PI/s1600/username.PNG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="320" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjGN6OvcE1Ppy_QysMKMjSKp1JFgKm0N58i1yqkRsRzEmOjdK5d-SR_lh4K_P9nRZwDt8dK20FwB74gPw4gIkAe8N4Q-XteKpbma71d0uM7ySFaYSXBQmHnNjMqGcoEniHAwxk1d0_qs_PI/s320/username.PNG" width="308" /></a></div><br />I also write <a href="http://pastebin.com/wzuUYPve">bash script</a> which generate possible username using first name, last name & birth date.<br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhShcl1Lqyus0LGwGqvxQ94GETGLVXxdy0iEVj_b5QbZvZXSPvWVaWGQai33dzL9GhrkjKujmcRH4nACwmAaFNmf0vnd_ksSdkHU3yw0nH9SvS4G-WcYiTCF_3DjYiahQ9Yji1of13eqW38/s1600/user-name.PNG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="320" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhShcl1Lqyus0LGwGqvxQ94GETGLVXxdy0iEVj_b5QbZvZXSPvWVaWGQai33dzL9GhrkjKujmcRH4nACwmAaFNmf0vnd_ksSdkHU3yw0nH9SvS4G-WcYiTCF_3DjYiahQ9Yji1of13eqW38/s320/user-name.PNG" width="199" /></a></div><div style="text-align: left;"><br /><a name="more"></a></div><h3 style="text-align: left;">Creating Custom word list:-</h3><div style="text-align: left;"><br />(1)<a href="http://www.digininja.org/projects/cewl.php">Cewl</a>:-</div><div style="text-align: left;"><br />Custom Word List generator. <a href="http://www.digininja.org/projects/cewl.php">CeWL</a> is a ruby app which spiders a given url to a specified depth, optionally following external links, and returns a list of words.</div><div style="text-align: left;"><br /></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjK6DYSD6jJsuQl07VgrqHSgNn3gtFOM1_tnRMSgGiaVExA1AF2kt9prBb1OnmIqo_RG2PUfaK7XKrjdVhsHjNFXc4Gjs2F5YLdyN8AlLsxeNTMYq-r032ovNX5A6kqViihxi4-qiVAC08A/s1600/cewl.PNG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="39" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjK6DYSD6jJsuQl07VgrqHSgNn3gtFOM1_tnRMSgGiaVExA1AF2kt9prBb1OnmIqo_RG2PUfaK7XKrjdVhsHjNFXc4Gjs2F5YLdyN8AlLsxeNTMYq-r032ovNX5A6kqViihxi4-qiVAC08A/s320/cewl.PNG" width="320" /></a></div><div style="text-align: left;"><br /><br />(2)<a href="http://www.remote-exploit.org/content/wyd-0.2.tar.gz">Wyd</a>:-</div><div style="text-align: left;"><br /><a href="http://www.remote-exploit.org/content/wyd-0.2.tar.gz">wyd</a> is a password profiling tool that extracts words/strings from supplied files and directories. It parses files according to the file-types and extracts the useful information, e.g. song titles, authors and so on from mp3's or descriptions and titles from images.</div><div style="text-align: left;"><br /></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg5kpsaEyQxrqlEwmMC_SyhAyUvMWAN9_mJCQil-dYrKWAoxOklCmeJp-Kj0fMopmjE0zGuRVhp34qBkmoCNNqOzIigDvrRdxKuEbdt3Q4aUuW_xY9LfyLpxgcs0eY-zCgaIMyaJi4k-gEA/s1600/wyd.PNG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="144" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg5kpsaEyQxrqlEwmMC_SyhAyUvMWAN9_mJCQil-dYrKWAoxOklCmeJp-Kj0fMopmjE0zGuRVhp34qBkmoCNNqOzIigDvrRdxKuEbdt3Q4aUuW_xY9LfyLpxgcs0eY-zCgaIMyaJi4k-gEA/s320/wyd.PNG" width="320" /></a></div><div style="text-align: left;"><br /></div><div style="text-align: left;"></div><div style="text-align: left;"><br />(3)<a href="http://www.remote-exploit.org/content/cupp-3.0.tar.gz">Cupp</a>:-</div><div class="separator" style="clear: both; text-align: center;"></div><div style="text-align: left;"><br />People spend a lot of time preparing for effective dictionary attack. <a href="http://www.remote-exploit.org/content/cupp-3.0.tar.gz">Common User Passwords Profiler (CUPP)</a> is made to simplify this attack method that is often used as last resort in penetration testing and forensic crime investigations. A weak password might be very short or only use alphanumeric characters, making decryption simple. A weak password can also be one that is easily guessed by someone profiling the user, such as a birthday, nickname, address, name of a pet or relative, or a common word such as God, love, money or password.</div><div style="text-align: left;"><br /></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh9Z_MlW9Q1Zr6biCzPutjcuzDTp3PKeK65JKfm44AyXnyudoaQtIxh3KwcwlUp0lOfL273ozSOUOnGP4EOA_LDFK1GDgz-JIjYFMvFHRNHRpieqvayMTbC5VlbpDTyYTwuJgVsUSybubAi/s1600/cupp.PNG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="320" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh9Z_MlW9Q1Zr6biCzPutjcuzDTp3PKeK65JKfm44AyXnyudoaQtIxh3KwcwlUp0lOfL273ozSOUOnGP4EOA_LDFK1GDgz-JIjYFMvFHRNHRpieqvayMTbC5VlbpDTyYTwuJgVsUSybubAi/s320/cupp.PNG" width="303" /></a></div><div style="text-align: left;"></div></div>

Creating custom username list & wordlist for bruteforciing.

During brute-forcing every time you need custom password list & username list. Username list is as well as important as password list, ...

+ Read more »

Brute-Force attack using HYDRA

<div dir="ltr" style="text-align: left;" trbidi="on"><h3 style="text-align: left;">What is BRUTE-FORCE attack ?</h3><br />A password attack that does not attempt to decrypt any information, but continue to try different passwords. For example, a brute-force attack may have a dictionary of all words or a listing of commonly used passwords. To gain access to an account using a brute-force attack, a program tries all available words it has to gain access to the account. Another type of brute-force attack is a program that runs through all letters or letters and numbers until it gets a match.<br /><br /><h3 style="text-align: left;">How to install THC-hydra ?</h3><br />Open your terminal & type following command<br /><br />(1)sudo bash<br /><br />(2)wget http://freeworld.thc.org/releases/hydra-6.3-src.tar.gz<br /><br />(3)After downloading ,we are going to extract it<br /><br />tar -xvf hydra-6.3-src.tar.gz<br /><br />(4)tar -xvf hydra-6.3-src.tar.gz<br /><br />(5)./configure && make && install<br /><br />(6)make install<br /><br /><br /><h3 style="text-align: left;">How to use THC-hydra?</h3><br />If you are attacking FTP service then first make sure to run an nmap scan for any open FTP ports (by default it should be 21)<br /><br />Now in order to brute-force a specific login form you need to define the user-name (if you don't know it include a file containing some), the word-lists directory, the service attacking and form method and the page itself.<br /><br />Type following command in terminal<br /><br />hydra -l admin -P /root/pass  127.0.0.1 http-post-form "/mutillidae/index.php?page=login.php:username=^USER^&password=^PASS^&login-php-submit-button=Login:Not Logged In"<br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjnNE7GTPVhtjN2r0EOchrPiGdDZvfLDexx1Srjk6gkRluI7Tn6BLG3S9an6mZC0n4DP_Q1zWGwIkkkaC3qe7TsMDQjupQCa3s4_HPnW5-mOdpVjKg3L-yoh7iondcKsYC_Vi7mP7QGd844/s1600/hydra.PNG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="hydra-bruteforce" border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjnNE7GTPVhtjN2r0EOchrPiGdDZvfLDexx1Srjk6gkRluI7Tn6BLG3S9an6mZC0n4DP_Q1zWGwIkkkaC3qe7TsMDQjupQCa3s4_HPnW5-mOdpVjKg3L-yoh7iondcKsYC_Vi7mP7QGd844/s1600/hydra.PNG" title="hydra-bruteforce" /></a></div><br />The -l switch defines the username and the capital -L - a list of usernames for the brute-force attack (if you don't know the login). <br /><br />The -p switch defines the password and the capital -P - the directory for the wordlists ( the -P is used almost always) <br /><br />If we're attacking a web form over http and the method is post then we use "http-post-form" if the service is FTP simply use "ftp". <br /><br />Another thing you should be aware of is that the variables username and password are not always the same. They different depending on the code. <br /><br />They could be usr,pwd etc - it's not necessarily for them to be as in most cases "username" & "password". Just view the source and make sure what their names are. <br /><br />Now there are a lot more options of Hydra. I'll explain some of them below no matter that they are included in the MAN page of hydra<br /><br />-vV - The verbose mode. This mode shows you every login attempt hydra tries. <br /><br />-s - We specify the port on which we're running our attack.<br /><br />-x - For brute-force parameters generation. We define our charset and minimum & maximum length of it.<br /><br />-R - Restores a previously aborted session of an attack.<br /><br />-e ns - Checks for blank or no password fields.<br /><br /></div>

Brute-Force attack using HYDRA

What is BRUTE-FORCE attack ? A password attack that does not attempt to decrypt any information, but continue to try different passwords. Fo...

+ Read more »