Online Password Cracking using Hydra

Online password attacks can be performed using Hydra. Actually, Hydra is an online password guessing tool that can be used to test usernames and passwords for running services. Hydra can be used in both interfaces GUI (Graphical User Interface) as well as CLI (Command Line Interface).

Deliverable 1:

Lab Set up

• Virtualization using Oracle Virtual box

• Attacker’s System: Kali Linux

• Target System : Metasploitable 2

In Kali Linux --> Terminal

To perform online password attack to a particular port of the system with the help of wordlist of usernames and passwords using Hydra command line interface.

~# hydra –L [username_list.txt] -P [password_list.txt] [target_ip] [port_name]

Here, hydra --> online password cracking tool

-L --> login file

[username_list.txt] --> wordlist file of the potential usernames

-P --> password file

[password_list.txt] --> wordlist file of the potential passwords

[target_ip] --> IP address of the target system

[port_name] --> name of the port to be attacked (e.g. ftp, http, etc.)

The above command will try to crack the password for a particular port on the target using wordlist of potential usernames and passwords.

Deliverable 2:

Lab Set up

Attacker’s System: Kali Linux

Target System: Metasploitable 2

To perform online password attack to a particular port of the system with the help of wordlist of usernames and passwords using Hydra Graphical User Interface.

In Kali Linux System

--> Applications

--> Kali Linux

--> Password Attacks

--> Online Attacks

--> hydra-gtk

Now under ‘target’ tab, provide the information needed like IP address of single target, port number and protocol. Tick ☑ on ‘Be Verbose’ and ‘show Attempts’ to see the background process. Now under password tab, a single username and password can be provided or the wordlist files of potential username and password can be provided. Then under ‘Start’ tab, click on the start button.

This will try to crack the password for a particular port on the target.

Note: The sample wordlist to be used for above exercise can have following words. You can make your own too.

Sample wordlist for username:

Parag

Abc

msfadmin

admin

12345

Sample wordlist for password:

Tailor

Xyz

msfadmin

password

987456