Brute Force Attack: The principle of brute force attack is to use the attacker's own username and password dictionary to enumerate them one by one and try to log in. In theory, as long as the dictionary is large enough, enumeration will always be successful!
This tutorial uses dictionary brute force attack and does not use exhaustive method.
Table of Contents:
File Cracking:
- Brute force cracking of compressed files (zip, rar).
Divided into kali and windows
- Cracking encrypted Excel files.
Web Brute Force Attack
- MSF brute force attack on Metasploitable2-Linux services
(ftp, ssh, telnet, mysql, postgresql, vnc)
-
Brute force cracking with hydra tool
-
Brute force cracking with Medusa
-
Brute force attack on Windows 3389, 21, 3306, 5900
-
PkavHTTP Fuzzer 1.5.6 CAPTCHA cracking
Cracking zip compression package using fcrackzip
This is a tool for cracking zip compression packages in kali.
Step 1: Open kali terminal and enter the command: fcrackzip -h to view the help file
Step 2: Transfer an encrypted compressed zip file to kali and use the following command to crack it:
fcrackzip -u -D -v -p /root/Desktop/password.txtopenurl.zip
-u: Use decompression to clear incorrect passwords
-D: Use dictionary file
-p: Specify dictionary path openurl.zip is your own compressed file
Step 3: The password is www.163.com and the cracking is successful
There is another tool called rarcrack for cracking rar in Linux, which can be installed in kali, but this tool can be ignored directly (because it is not easy to use).
Cracking in Windows:
- Step 1: First download the software "ARCHPR" and install it.
Step 2: Transfer the encrypted zip and rar files to the XP system.
Step 3: Open the compressed file and select "Dictionary" in the attack type---select a dictionary file in the dictionary file path.
Step 4: Click "Start" to crack it successfully. The password is in the red box.
The cracking of Rar password is similar and will not be demonstrated here.
Cracking encrypted Excel files
This software is provided in Xuanjian 2.0.
Web service brute force attack
When we scan the server, the server will open a large number of service ports, and these services may have corresponding vulnerabilities that can be exploited. Brute force attack may exist.
Brute force attack on Metasploitable2-Linux services (IP address for this tutorial: 192.168.172.129)
You can see that there are many ports corresponding to services. There are:
ftp, ssh, telnet, smtp, domain, http, rpcbind, netbios-ssn, exec,
login, shell, rmiregistry, ingreslock, nfs, ccproxy-ftp,
mysql, postgresql, vnc, xll, irc, ajp13
Many of them have vulnerabilities that can be brute-forced.
Brute force attack on ftp
Ftp is commonly used on port 21
Step 1: Detailed scan of port 21
-sV: Detect port service version
-p 21: Port 21
From the above results, it can be seen that the FTP server uses vsftpd 2.3.4 version, which has an anonymous login vulnerability, but we won't discuss it today. What we are going to write is the brute force attack vulnerability, which is actually a weak password vulnerability. Strong passwords cannot be brute-forced either.
Step 2: Start msfconsole
Step 3: Use the brute force module (use auxiliary/scanner/ftp/ftp_login)
MSF's brute force modules are regular. They are all in auxiliary/scanner/ followed by the corresponding service.
Step 4: Set the corresponding parameters
Step 5: Perform brute force, exploit
The username and password that have been successfully cracked are displayed in the red box.
Brute force attack on ssh
ssh defaults to port 22, which is a tool for connecting to terminals in Linux.
Step 1: Detailed scan of port 22 (omitted)
nmap -sV -p 22 192.168.172.129
Step 2: Start msfconsole
Step 3: Use the brute force module
use auxiliary/scanner/ssh/ssh_login
Step 4: Set the relevant parameters
Step 5: Perform brute force, and the brute force is successful
The username and password that have been successfully cracked are in the red box.
The methods for brute force attack on telnet, mysql, postgresql, and VNC are the same. The key is the dictionary, but combining with AI tools should be able to generate better dictionaries.