In this lesson,
we're going to demonstrate how to crack a password
using several popular password cracking tools:
Hashcat, John the Ripper, Hydra, and Medusa.
We'll start by creating a MD5 hash of a password
and then we'll use each tool to crack it.
First, we're going to look at the wordlist
that we'll be using to crack these hashes.
The one I'm going to use is the rockyou.txt file.
So first I'm going to use the head command.
And this is the location of it.
It's going to be under the usr/share/wordlists folder,
rockyou.txt.
The head command's just going to show us the top 10.
So there's going to be just the first 10
that's in this wordlist and we see all the basic passwords.
We see the 123456, password, iloveyou, et cetera.
So we're going to use the echo command
and we're going to use password ABC123
and convert that into a MD5 hash.
Now we have the pipe command here,
which is going to insert the results
from echo, ABC123, into
the md5sum hash algorithm.
Now we need to perform a little change
to the output from echo 'cause it adds a dash at the end.
So we need to make sure we remove that.
We're going to use the awk command
and then we want to put it into the hash.txt file.
Okay, now let's check that.
Okay, perfect.
So now we see we have the MD5 hash version
and only that in the hash.txt file.
Next we're going to use the Hashcat tool
to decrypt that file.
So to break this down: we have the hashcat command,
then we have the M option set to zero
meaning that that specifies the hash type,
where zero represents MD5.
So if you had one, that might be SHA-1
or you know, if you had two,
that might be SHA-256, et cetera.
And then we have the A option, 0
and that's the attack mode.
So zero represents a straight dictionary attack,
meaning that we're going to look in the wordlist
and compare that against the hash.txt file, all right?
Okay, great.
Now we see here, it clearly found the hash for us.
ABC123.
Next, we're going to get started with John the Ripper,
another popular password cracking tool.
It's really known for its flexibility and extensive options.
So we're going to use that same hash.txt file from before
and get started.
Now here, we're going
to identify the type of hashing algorithm
that was used to create the hash file.
So we have the raw MD5 hash
'cause sometimes what happens is John is supposed to be able
to automatically detect
which type of hashing algorithm is being used,
but there's a lot of common
or similar hashing algorithms that might confuse it
and don't give us the best result.
So if you know the hashing algorithm,
go ahead and use the format option
to make sure that you select the correct one.
So here we have raw-md5 hash,
and then we have the wordlist option
where it's just going to be the path to the wordlist
that we used earlier, the rockyou.txt file.
And then we have the hash.txt,
which contains the hash that we will be cracking.
All right, that was simple enough.
So we see here, John the Ripper was able
to crack the hash very quickly using our word list.
So this is just a basic example of a dictionary attack.
Okay, so now that we've successfully demonstrated
how to crack a MD5 hash using Hashcat and John the Ripper,
let's move on to another aspect of password cracking,
which is brute force attacks on network services.
So we're going to focus on an FTP server using two tools.
So we're going to focus on Hydra and Medusa.
So let's begin with Hydra
and I think the biggest thing to do is always look
at the different options that are available.
Let's look at Hydra.
Do this H option.
Here we see all the different things that we can do here.
Okay, but we're going to be very basic with this example.
So we're going to focus on this first example here.
So we're going to simply just use the l option,
which is going to give us the username.
So we're going to input the user called ftp user,
and then we have the -P option,
which is the password list
or wordlist that we'll be using
to actually crack this particular user's password.
And then we're going to use the FTP
and this is going to be on our local system
just for the sake of example,
but if this was an external system,
you would input the IP address right here.
And we see there's a lot of different options,
the more common options, right?
If we want to do -L, that's when we have a list of users
instead of specifying one user and so on and so forth.
So if you want to get,
you know, more familiar with the service,
you just go through and just kind of,
just look at all the different options,
but we're going to keep it very basic and very simple.
We're going to use hydra -l.
We're going to put our user here
and we'll use the password list, okay?
All right, so here's the command
we're going to use for Hydra.
So as I mentioned earlier, we're going to use hydra -l,
so it's going to be the username
that we're going to be trying to attack.
Then we're going to use the -P option.
That's going to give us the option to input the wordlist
that we will be trying to use
to actually attack this ftpuser account.
And then we're going to specify the service.
So FTP and then where it's located.
So it's going to be our local server.
So that means it's going to be 127.0.0.1.
All right, so we see that was fairly simple, right?
So it went through, it looked through the wordlist,
password's part of the common wordlist,
and it found the password for ftpuser, which was password.
So I had to make it very simple so we can just go ahead
and see how the system operates.
But again, I love the output of Hydra.
It's very clean, it highlights things.
Some of the other tools might be a little bit more ambiguous
as far as letting you know it's successful.
But we see how Hydra quickly went through,
used the wordlist and cracked the password for ftpuser.
Now next we'll be focusing on Medusa.
Very similar to Hydra,
Medusa is good for attacking services.
So we're going to use some Medusa command.
I'm going to use the -help option.
Again, to get familiar with these tools and the options,
you must use the help or -h option
and it lets you just see
all the different things that you can do.
Now we're going to use Medusa -h option.
So we're going to specify the IP address first.
Okay, so it's a little different from Hydra.
And then we're going to go to the actual username.
So we're going to do -u.
So we're going to use ftpuser again.
And then we're going to focus on the -P option.
So we're going to specify the wordlist
that we're going to test against the ftpuser password.
And then slightly different again from Hydra,
we need to specify the service
instead of just putting it in front of the IP address.
We're going to use the -M option here, okay, capital M.
And it's going to be the name of the module to execute.
So that's going to pretty much mean FTP server, all right?
Medusa -h, and it's going to be the complete
password redo,
and it's going to be the complete command for that.
So again, we're going to use Medusa,
the -h option, specifying the actual IP address,
which is going to be our local server.
The -u option which is going to be the ftpuser.
So we're specifying one user.
We could use a list of users,
but in this example, we're going to use one user.
And then the capital P option,
that's going to give us the password list
that we're going to be trying to guess it.
And then we want to use the -M option.
That's just going to specify our service, which will be FTP.
All right, perfect, so again, it found the password.
So account found, ftpuser, passwords going to be password.
So very simple, nice clean output, kind of like Hydra.
So just in summary, we demonstrated
how to crack passwords using several popular tools.
So Hashcat, John the Ripper, Hydra, and Medusa.
We started by creating a MD5 hash of a password
and then we used Hashcat and John the Ripper
to successfully crack it.
And then afterwards, we shifted our focus
on brute-forcing attacks on an FTP server
using Hydra and Medusa.
I hope you liked this demonstration
and I'll see you in the next one.