Module 6.5: Brute force attacks: Hydra

Brute force dictionary attacks: hashing, hashcat and hydra

Install hydra and hashcat: home brew example

brew install hydra hashcat

On linux machines:

sudo apt install hydra hashcat -y

Hashcat: 

• decodes hashes by comparing them with a wordlist of known hashes
  
• you must have a local copy of the hashes to do this
  
• if you have a modern gaming GPU, this can be very fast
• you don't have to maintain a connection to do this once you have the hashed file
• can use huge dictionary to decode hash

Hydra: 

• does the same using ssh to attack a remote computer
  
• must have a constant connection to the computer to attack (e.g. can be detected)
• can attack computers inside a network, but not through firewalls
  
• can make millions of attacks per second using a large dictionary stored locally

Hashing:

Example:use the online utility to create a SHA512 hash for Toomanysecrets77:

da355c585ad36b98017d11ed3fd05199acbb2855345dc463f61fc42fdf6656c9

is a SHA256 hash of Toomanysecrets77 (a secret password)

try this out, make sure you get the same result

Local password attack demo: hashcat

create your own word list of passwords:

sudo nano wordlist.txt

insert these, one on each line: 

papaya77 
Toomanysecrets77 
hashcat
pal82

ctrl-o, save and then ctrl-x

next: create another file on your machine:

sudo nano hashes.txt

Generate SHA512 hashes for each password and copy the hashes into this file, ctrl-o, save, ctrl-x

Run hashcat to decode the hashes:

hashcat -m 1400 -a 0 hashes.txt wordlist.txt

or this

sudo hashcat -m 1400 -a 0 hashes.txt wordlist.txt --outfile=cracked.txt --outfile-format=2

show results:

sudo hashcat --show -m 1400 hashes.txt

what does this do?

1. opens hashcat
   
2. decodes format 1400 (SHA512 encryption) (mode)
3. attack mode, dictionary attack (-a)
4. use these two files

what do you see?

try again using this password file:

Download common-passwords.txt.zip (text/plain, 2.2 KB)

Download crackedpasswords.txt (text/plain, 82 B)

cd  /etc
cat shadow

sudo gzip -d rockyou.txt.gz

cat rockyou.txt

Migrated from Apple Server Wiki. Original page ID: 64m6w3W5k7