Brute force cracking: The principle of brute force cracking is to use the attacker's own username and password dictionary to enumerate and try to log in one by one. Theoretically, as long as the dictionary is large enough, enumeration will always be successful!
This tutorial uses dictionary brute force cracking and does not use exhaustive methods.
Table of Contents:
File cracking:
- Brute force cracking of compressed files (zip, rar).
Divided into Kali and Windows.
- Cracking encrypted Excel files.
Web brute force cracking
- MSF brute force cracking of Metasploitable2-Linux services
(ftp, ssh, telnet, mysql, postgresql, vnc)
-
Brute force cracking with Hydra tool
-
Brute force cracking with Medusa
-
Brute force cracking of Windows 3389, 21, 3306, 5900
-
PkavHTTP Fuzzer 1.5.6 captcha cracking
Using fcrackzip to crack zip files
This is a tool for cracking zip files in Kali.
Step 1: Open the Kali terminal and enter the command: fcrackzip -h to view the help file.
Step 2: Transfer an encrypted zip file to Kali and use the following command to crack it:
fcrackzip -u -D -v -p /root/Desktop/password.txtopenurl.zip
-u: Use decompression to clear incorrect passwords
-D: Use a dictionary file
-p: Specify the dictionary path, openurl.zip is your own compressed file
Step 3: The password "www.163.com" is successfully cracked.
There is another tool called rarcrack for cracking rar files in Linux, which can be installed in Kali, but it can be ignored because it is not easy to use.
Cracking in Windows:
- Step 1: First download the software "ARCHPR" and install it.
Step 2: Transfer the encrypted zip or rar file to the Windows XP system.
Step 3: Open the compressed file and select "Dictionary" in the attack type, and choose a dictionary file in the dictionary file path.
Step 4: Click "Start" to crack it successfully, and the password will be shown in the red box.
Similar steps can be followed for cracking RAR passwords. It will not be demonstrated here.
Cracking encrypted Excel files
This software is provided in Xuanjian 2.0.
Web service brute force cracking
When scanning servers, a large number of service ports will be opened, and these services may have vulnerabilities that can be exploited. Brute force cracking may be possible.
Brute force cracking of Metasploitable2-Linux services (IP address for this tutorial: 192.168.172.129)
Many ports correspond to services. They are:
ftp, ssh, telnet, smtp, domain, http, rpcbind, netbios-ssn, exec,
login, shell, rmiregistry, ingreslock, nfs, ccproxy-ftp,
mysql, postgresql, vnc, xll, irc, ajp13
Many of them have vulnerabilities that can be brute forced.
FTP brute force cracking
FTP is commonly used on port 21.
Step 1: Detailed scan of port 21
-sV: Detect port service version
-p 21: Port 21
From the above results, it can be seen that the FTP server uses vsftpd 2.3.4 version, which has an anonymous login vulnerability, but today we are going to write about brute force cracking vulnerabilities, which are weak password vulnerabilities that cannot be cracked with strong passwords.
Step 2: Start msfconsole
Step 3: Use the brute force module (use auxiliary/scanner/ftp/ftp_login)
MSF's brute force modules are organized in a systematic way. They are all in the format of auxiliary/scanner/ followed by the corresponding service.
Step 4: Set the relevant parameters
Step 5: Perform the brute force attack, exploit
The username and password for successful brute force cracking will be displayed in the red box.
Brute force cracking of SSH
SSH is usually on port 22 and is a tool for connecting to terminals in Linux.
Step 1: Detailed scan of port 22 (skipped)
nmap -sV -p 22 192.168.172.129
Step 2: Start msfconsole
Step 3: Use the brute force module
use auxiliary/scanner/ssh/ssh_login
Step 4: Set the relevant parameters
Step 5: Perform the brute force attack, and if successful, the result will be shown in the red box.
The same method can be applied for brute force cracking of telnet, mysql, postgresql, and VNC. The key is the dictionary, but combining AI tools should generate better dictionaries.