A dictionary attack is very simple. We take a username, a list of common or likely passwords, and then try to log in with each password found in the list.

There are numerous ways to perform such an attack. In this exercise, we use a password list found at the path /usr/share/wordlists/common-passwords.txt on the training machine, as well as a command line tool called THC Hydra to automate the guessing process. Start the exercise and continue reading!

In this lab, you get to perform a dictionary attack (also known as a brute force attack) on the application and attempt to gain access to the admin user account.

Dictionary attack

Let's find out what kind of HTTP request is sent regarding the login attempt, as well as how to distinguish a successful or unsuccessful login from the HTTP response.

Start by logging into the application and then search for the login request in burp's HTTP history:

Send the request with the correct password first and examine the HTTP response. It can be inferred that the correct response is for example:

Then send the same request with the wrong password. It can be deduced that the wrong answer is, for example:

Body contains "Invalid username or password"

Finally, examine the HTTP request itself. It is a 

Hydran syntax in this case is as follows:

, which means instead of a username, a file with multiple usernames. 

, which in turn means a password list. However, let's first try with just one username and password, namely yours, to ensure Hydra works correctly.

 is a suitable power so that the lab does not crash. The default is 16, which may be a bit heavy for the application.

In the body, the places where the username and password are entered are marked with the texts 

: your lab's domain, for example www-0xrue3l19e.ha-target.com

: https-post-form (a module in Hydra that handles urlencoded HTTPS POST forms)

: Invalid (HTTP response indicating a failed login attempt contains the text "Invalid")

So you could try Hydra roughly like this:

If the experiment seems to work, try the wrong password next. This time Hydra should not succeed.

In order to initiate the actual attack, we make two modifications to the Hydra command.

We change the username to the target of the attack's email address, which in this case is jessica.blanchard@ha-target.com (in your lab, the admin's email can be found on the front page of the lab).

Instead of a password (-p), we use a password list (-P) located at the path /usr/share/wordlists/common-passwords.txt

Then you simply wait for a moment while Hydra goes through the password list, and if all goes well, you will get the admin user password!

To best protect an application that uses passwords against dictionary attacks, temporarily disable user login for the username after a few, for example, five unsuccessful attempts.

Salasanoja käyttävän sovelluksen voi parhaiten suojata sanakirjahyökkäyksiä vastaan estämällä käyttäjätunnukselle kirjautumisen väliaikaisesti muutaman, esim. viiden epäonnistuneen yrityksen jälkeen.

Protecting your application from a dictionary attack

Sovelluksen suojaaminen sanakirjahyökkäykseltä

@embed 0a2a28c02f72

A dictionary attack is very simple. We take a username, a list of common or likely passwords, and then try to log in with each password found in the list.

## Exercise

There are numerous ways to perform such an attack. In this exercise, we use a password list found at the path /usr/share/wordlists/common-passwords.txt on the training machine, as well as a command line tool called THC Hydra to automate the guessing process. Start the exercise and continue reading!

@exercise 74bd660f3a15

---

## Preparation

Let's find out what kind of HTTP request is sent regarding the login attempt, as well as how to distinguish a successful or unsuccessful login from the HTTP response.

Start by logging into the application and then search for the login request in burp's HTTP history:

![](sanity:image-6933d167fd838bddfd3946fa5bc68a0a3c671308-731x322-png)

Send the request to the repeater:

![](sanity:image-d5a401557113b9214ebe304b9d13d6e1876e6f26-731x322-png)

Send the request with the correct password first and examine the HTTP response. It can be inferred that the correct response is for example:

- Returns HTTP status code 302
- Body contains the text "Redirecting..."
- It is about 200 characters long.

@embed 37edbcb13402

Then send the same request with the wrong password. It can be deduced that the wrong answer is, for example:

- Returns HTTP status code 200
- Body contains "Invalid username or password"
- It is about 5000 characters long.

@embed e643699274c6

Finally, examine the HTTP request itself. It is a **POST** request to the path **/login**, with a content type of **application/x-www-form-urlencoded** and with two parameters in the body, **email** (user's email address) and **password** (user's password).

With this information, we can proceed!

---

## Configuring Hydra

Hydran syntax in this case is as follows:

hydra -t **<power (threads)>** -l **<username>** -p **<password>** **<domain> <module>** "**<path>**:**<body>**:F=**<text indicating failed login>**".

**-l **can be replaced with a capital **-L**, which means instead of a username, a file with multiple usernames. **-p** can also be replaced with a capital **-P**, which in turn means a password list. However, let's first try with just one username and password, namely yours, to ensure Hydra works correctly.

**-t 4** is a suitable power so that the lab does not crash. The default is 16, which may be a bit heavy for the application.

In the body, the places where the username and password are entered are marked with the texts **^USER^** and **^PASS^**.

- **username**: student@ha-target.com
- **password**: student
- **domain**: your lab's domain, for example www-0xrue3l19e.ha-target.com
- **module**: https-post-form (a module in Hydra that handles urlencoded HTTPS POST forms)
- **path**: /login
- **body**: email=^USER^&password=^PASS^
- **failed login**: Invalid (HTTP response indicating a failed login attempt contains the text "Invalid")

So you could try Hydra roughly like this:

```sh
Hydra -t 4 -l "student@ha-target.com" -p student www-0xrue3l19e.ha-target.com https-post-form "/login:email=^USER^&password=^PASS^:F=Invalid "
```

![](sanity:image-63e23bab2ad0ee40b2a07ea31e32a63861a0c485-824x135-png)

If the experiment seems to work, try the wrong password next. This time Hydra should not succeed.

```sh
Hydra -t 4 -l "student@ha-target.com" -p InvalidPassword www-0xrue3l19e.ha-target.com https-post-form "/login:email=^USER^&password=^PASS^:F=Invalid "
```

![](sanity:image-418bcc976f657dad0ad1d95cd3f56d3bec9d9660-651x186-png)

---

## Launching an Attack

In order to initiate the actual attack, we make two modifications to the Hydra command.

- We change the username to the target of the attack's email address, which in this case is jessica.blanchard@ha-target.com (in your lab, the admin's email can be found on the front page of the lab).
- Instead of a password (-p), we use a password list (-P) located at the path /usr/share/wordlists/common-passwords.txt

```sh
Hydra -t 4 -l "jessica.blanchard@ha-target.com" -P /usr/share/wordlists/common-passwords.txt www-0xrue3l19e.ha-target.com https-post-form "/login:email =^USER^&password=^PASS^:F=Invalid"
```

Then you simply wait for a moment while Hydra goes through the password list, and if all goes well, you will get the admin user password!

![](sanity:image-02aeaa84fd5fb09f737e8fb0094cdada45c3010e-651x186-png)

@embed b1f0d5fb87a6


Dictionary Attack

Passwords are terribly insecure for an awful lot of reasons, but still necessary. A dangerous combination!

Passwords are unbelievably insecure for a number of horrifying reasons, but still necessary. A dangerous combination!

Dictionary Attack

Exercise

Learn to hack — start here