[Video] How to: Crack HTTP (hydra)

[g0tmi1k]

Hey all!

A (very) short video on how to crack your routers password!

What is this?
A basic guide on how to use hydra to crack a http password on your home router.

How does this work?
> Uses a dictionary attack to test for weak or simple passwords on one or more remote clients
> Supports multiple protocol

What do I need?
> Hydra
> Big dictionary.

Commands:

hydra -l admin -P /pentest/passwords/wordlists/g0tmi1k.lst -e ns -t 15 -f -s -vV 192.168.1.1 http-get / -l = username

-P = password (Looks for a wordlist cos its a 'big' P)
-e ns = checks for 'null' password
-t xx= How many tasks to run at once
-f = exit once it finds the first user/password
-s = connect via SSL
-vV = verbose mode (shows more info)
192.168.1.1 = IP address
http-get = what to crack/method etc
/ = Page to crack - root

Notes:
This is cut from my final video called "g0tmi1k's home network".
The password HAS to be in the dictionary - so if you use something like http://grc.com/pass, the chances of it being crack is next to nothing!

Links
Download: 2 - hydra.mp4 - g0tmi1k
Video: How to: Crack HTTP
Idea/Source(s): xHydra
Misc : Dictionaries

Software
Name: Hydra
Version: 5.4
Home Page: #!/bin/the hacker's choice - THC
Download Link: The Hacker's Choice Download



~g0tmi1k

[Dooms_day]

very cool, just in case i need to forward my ports from a starbucks right? lol

most people just use a default "password1" or no pass at all is what im finding though

[thrasher12ga]

Nice easy howto for the newcomers. Win.
Also kudos for making the video in something other than Flash. I'm sure I'm not the only one who refuses to install Flash under Windows.

FYI for the win32 version there's a lazy man's GUI here (GeoGen Hydra GUI)
w w w.geogensoft.com/products/geogen-hydra-gui.html
Cheeky pricks want $15 for a frontend to an opensource tool though.

[slacker_]

if you don't need an graphical frontend you can also use "medusa" from _foofus.net_ (which is fine :-)

[letmein]

I would like to test our outlook web access (owa) but every time I run hydra I get "cannot resolve xx.xx.xx.xx"?

My command is (this is using the windows version... sorry)

hydra -L login.txt -P pass.txt -V service https xx.xxx.xxx.xxx https-get /exchange

Any ideas???

[Almighty]

Originally Posted by letmein

I would like to test our outlook web access (owa) but every time I run hydra I get "cannot resolve xx.xx.xx.xx"?

My command is (this is using the windows version... sorry)

hydra -L login.txt -P pass.txt -V service https xx.xxx.xxx.xxx https-get /exchange

Any ideas???

HTTPS isn't supported by hydra. That should be the reason you cannot connect.

[letmein]

Originally Posted by Almighty

HTTPS isn't supported by hydra. That should be the reason you cannot connect.

There are options in hydra for https-get and post, so I am guessing Hydra does support HTTPS..... anyone any experience of using hydra on https?

Thanks