Hack Like a Pro: How to Crack Online Passwords with Tamper Data & THC Hydra « Null Byte :: WonderHowTo

Welcome back, my tenderfoot hackers!Not too long ago, I showed how to findvariousonlinedevicesusingShodan. As you remember, Shodan is a different type of search engine. Instead of indexing the content of websites, it pulls the banner of web servers on all types of online devices and then indexes the content of those banners.This info can be from any type of device including web servers, routers, webcams, SCADA systems, home security systems, and basically anything that has a web interface, which in 2014, means just about everything.I mentioned inmy first Shodan tutorialthat you can often access these devices by simply using the default username and password, as administrators are often lazy and neglectful. The question we want to address in this tutorial is—what do we do when the site requires credentials and the defaults don't work?There is tool that is excellent for cracking online passwords and it is calledTHC-Hydra. Fortunately, it is built intoour Kali distribution, so we don't need to download, install, orcompileanything to use it.Image viaShutterstockStep 1: Download & Install Tamper DataBefore we start with THC-Hydra, let's install another tool that complements THC-Hydra. This tool is known as "Tamper Data", and it is a plug-in for Mozilla's Firefox. Since our IceWeasel browser in Kali is built on the open source Firefox, it plugs equally well into Iceweasel.Tamper Data enables us to capture and see the HTTP and HTTPS GET and POST information. In essense, Tamper Data is a web proxy similar to Burp Suite, but simpler and built right into our browser.Tamper Data enables us to grab the information from the browser en route to the server and modify it. In addition, once we get into more sophisticated web attacks, it is crucial to know what fields and methods are being used by the web form, and Tamper Data can help us with that as well.Let'sdownload it from hereand install it into Iceweasel.Install the Tamper Data Firefox add-on in Iceweasel.Step 2: Test Tamper DataNow that we have Tamper Data installed into our browser, let's see what it can do. Activate Tamper Data and then navigate to any website. Below you can see that I have navigated to Bank of America and Tamper Data provides we with each HTTPS GET and POST request between my browser and the server.HTTPS GET and POST requests for BOA.When I try to login to the site with the username "hacker", Tamper Data returns to me all the critical info on the form. This information will be useful when we begin to use Hydra to crack online passwords.Tamper Data information for BOA login.Step 3: Open THC HydraNow that we have Tamper Data in place and working properly, let's open Hydra. You can find it atKali Linux->Password->Online Attacks->Hydra. You can see it about midway among the list of online password cracking tools.Select the "hydra" tool.Step 4: Understand the Hydra BasicsWhen we open Hydra, we are greeted with this help screen. Note the sample syntax at the bottom of the screen. Hydra's syntax is relatively simple and similar to other password cracking tools.The initial help screen for Hydra.Let's take a look at it further.hydra -l username -p passwordlist.txt targetTheusernamecan be a single user name, such as "admin" or username list,passwordlistis usually any text file that contains potential passwords, andtargetcan be an IP address and port, or it can be a specific web form field.Although you can use ANY password text file in Hydra, Kali has several built in. Let's change directories to/usr/share/wordlists:kali > cd /usr/share/wordlistsThen list the contents of that directory:kali > lsYou can see below, Kali has many word lists built in. You can use any of these or any word list you download from the web as long as it was created in Linux and is in the .txt format.The default word lists available in Kali.Step 5: Use Hydra to Crack PasswordsIn the example below, I am using Hydra to try to crack the "admin" password using the "rockyou.txt" wordlist at 192.168.89.190 on port 80.An example of using Hydra.Using Hydra on Web FormsUsing Hydra on web forms adds a level of complexity, but the format is similar except that you need info on the web form parameters that Tamper Data can provide us.The syntax for using Hydra with a web form is to use <url>:<formparameters>:<failure string> where previously we had used the target IP. We still need a username list and password list.Probably the most critical of these parameters for web form password hacking is the "failure string". This is the string that the form returns when the username or password is incorrect. We need to capture this and provide it to Hydra so that Hydra knows when the attempted password is incorrect and can then go to the next attempt.In my next Hydra tutorial, I will show you how to use this information to brute-force any web form including all those web cams, SCADA systems, traffic lights, etc. that we can find onShodan.Want to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseCover image viaShutterstockRelatedHack Like a Pro:How to Crack Online Web Form Passwords with THC-Hydra & Burp SuiteHow To:Brute-Force Email Using a Simple Bash Script (Ft. THC Hydra)Hack Like a Pro:How to Crack Passwords, Part 1 (Principles & Technologies)Hack Like a Pro:How to Hack Web Apps, Part 1 (Getting Started)How To:Using Hydra 5.4 to crack FTP passwordsNews:How to Study for the White Hat Hacker Associate Certification (CWA)News:8 Tips for Creating Strong, Unbreakable PasswordsHow To:Hack Wireless Router Passwords & Networks Using HydraHow To:Audit remote password using THC-HydraHow To:Hack Mac OS X Lion PasswordsHow To:How Hackers Take Your Encrypted Passwords & Crack Them