Skip to main content

Brute-force Attacks

We start off our discussion of UNIX attacks with the most basic form of attack— brute-force password guessing.  A brute-force attack may not appear sexy, but it is one of the most effective ways for attackers to gain access to a UNIX system.  A  brute-force attack is nothing more than guessing a user ID/password combination on a service that attempts to authenticate the user before access is granted. The most common types of services that can be brute-forced include the following:
 • telnet
 •  File Transfer Protocol (FTP)
 •  The “r” commands (rlogin, rsh, and so on)
 •  Secure Shell (ssh)
 •  SNMP community names
 • Post  Offi ce Protocol (POP) and Internet Message  Access Protocol (IMAP)
 •  Hypertext Transport Protocol (HTTP/HTTPS)
 •  Concurrent Version System (CVS) and Subversion (SVN)

Services such as finger, rusers, and sendmail are used to identify user accounts on a target system. Once attackers have a list of user accounts, they can begin trying to gain shell access to the target system by guessing the password associated with one of the IDs. Unfortunately, many user accounts have either a weak password or no password at all. The best illustration of this axiom is the “Joe” account, where the user ID and password are identical. Given enough users, most systems will have at least one Joe account. To our amazement, we have seen thousands of Joe accounts over the course of performing our security reviews. Why are poorly chosen passwords so common? People don’t know how to choose strong passwords or are not forced to do so.
Although it is entirely possible to guess passwords by hand, most passwords are guessed via an automated brute-force utility.  Attackers can use several tools to automate brute forcing, including the following:
THC – Hydra
 • pop.c  
 • SNMPbrute
Also read ―> Cracking Files
Hydra is one of the most popular and versatile brute force utilities available. Hydra includes many features and supports a number of protocols. The following example demonstrates how hydra can be used to perform a brute force attack:
In this demonstration, we have created two files. The users.txt file contains a list of five usernames and the passwords.txt contains a list of five passwords. Hydra will use this information and attempt to remotely authenticate to a service of our choice, in this case SSH. Based on the length of our lists, a total of 25 username and password combinations are possible. During this effort, hydra shows three of the five accounts were successfully brute forced. For the sake of brevity, the list included known usernames and some of their associated passwords. In reality, valid usernames would first need to be enumerated and a much more extensive password list would be required. This of course would increase the time to complete, and no guarantee is given that user’s password is included in the password list.  Although hydra helps automate brute-force attacks, it is still a very slow process.

NOTE: This is for educational purpose only we are not responsible for any type of inconvenience caused by reader.


Popular posts from this blog

Social Engineering Toolkit (SET)

Social Engineering Toolkit  (SET) is an advanced,  multifunctional, and easy-to-use computer-assisted social engineering toolset, created by the founders of  TrustedSec ( It helps you prepare the most effective way to exploit client-side application vulnerabilities and makes a fascinating attempt to capture the target's confidential information (for example, e-mail passwords). Some of the most efficient and useful attack methods employed by SET include targeted phishing e-mails with a malicious file attachment, Java applet attacks, browser-based exploitation, gathering website credentials, creating infectious portable media (USB/ DVD/CD), mass-mailer attacks, and other similar multiattack web vectors. This combination of attack methods provides you with a powerful platform to utilize and select the most persuasive technique that could perform an advanced attack against the human element.

 To start SET, navigate to  Applications  |  Kali Linux  |  Expl…

Cracking Wifi Using :Fern(GUI)


As a part of Kali linux , fern can be directly used from kali linux , i would be recommending the use of kali because while using other linux environments it could be a trouble because while using fern it automatically detects the path of aircrack-ng and python installed , while in other environments it is needed to set it follow the following steps :-->

1.) Download kali linux iso and make a bootable pendrive .....if you dont know how to make bootable pendrive  then follow the steps given in blog of trinity rescue kit

Kali linux iso (amd64) recommended -->here
Link to trinity rescue kit blog --> here

 2.)Open Kali linux Goto Applications-->Wireless Attack--> Fern

3.)Select Interface card wlan0

4.)Double click any where in GUI

5.)Select enable x-terms that you can view that happening ...while through a automated program...

6.)Click on select network

7.)Choose the type of network that is WEP/WPA

8.)I would recommend to add dictonary file .…

Deep Web - Part 1

What is deep web ?

Deep web Aka Invisible web Aka Hidden web are parts of the world wide web whose contents are not indexed by standard search engines.
The surface web also known as Visible web , Clearnet , Indexed web or Lightnet is that portion of the world wide web that is readily available to the general public and searchable with standard web search engines. Level of web where vast majority of internet users are connected to and which is accessible in any nation that does not block internet access.E.g: Social media sites like Facebook, informational websites like Wikipedia, general websites, etc


It is the part of world wide web that is not indexed by search-engines,which is directly accessible and no proxy required. E.g: Google locked results, recently web crawled old content, pirated media, pornography etc
Deep web Aka Invisible web Aka Hidden web are parts of the wo…