I believe all are familiar with Brute force attacks and we have already discussed some brute force attacks to hack gmail passwords.You can also read this how to hack gmail by brute force.But here, we are doing something different.Actually the technique we are using is Brute force only.But this is all about hacking passwords of servers and the tool we are using is called Brutus.
DOWNLOAD LINK
Extract all the files from the downloaded archive and open Brutus.you can see a window like this
What does Brutus do?
In simple terms, Brutus is an online or remote password cracker. More specifically it is a remote interactive authentication agent. Brutus is used to recover valid access tokens (usually a username and password) for a given target system. Examples of a supported target system might be an FTP server, a password protected web page, a router console a POP3 server etc. It is used primarily in two contexts :
· To obtain the valid access tokens for a particular user on a particular target.
· To obtain any valid access tokens on a particular target where only target penetration is required.
What is a target?
Well that depends on you. As far as Brutus is concerned a target is a remote system and possibly a remote user on a remote system, there is more. To engage any given target we require an attack method, generally we only perform one type of remote attack - that is we attempt to positivley authenticate with the target by using a number of access token combinations. A target may provide no available attack methods, it may provide one or it may provide several.
What is an attack method?
In the context of Brutus, it is a service provided by the target that allows a remote client to authenticate against the target using client supplied credentials. For instance a UNIX server sat on a network somewhere may be offering Telnet and FTP services to remote users. Both telnet and FTP require the remote user to authenticate themselves before access is granted. For both these services the required credentials are usually a username and a password, therefore we have two available attack methods : FTP or Telnet. Some target systems will provide no opportunity for attack (at least not a remote authentication attack), perhaps they offer no remote services, perhaps they only offer anonymnous remote services (that require no authentication) or perhaps they offer authenticated remote services but use mechanisms to prevent authentication attacks such as account lockout or one time passwords of some sort.
Which attack method is best?
Again, that depends on some factors which may include :
- Is the target service available to any remote system? (Yes is good)
- Does the target service require a single token (e.g. just a password) or multiple tokens (e.g. Username & password & domain?) (Single tends to be easier)
- Does the target service feature account lockouts or large delays before returning the result of the authentication attempt? (Yes is bad)
- Does the target service allow us to maintain a persistant connection? (Yes is good)
- Is the service supported by Brutus, if not can it be defined? (Yes is essential)
- Will a positive authentication against the service actually be useful for the overall objective? (Yes helps)
Basically, the fastest most reliable attack method is always the one to choose if you have a choice. Generally trouble free methods include HTTP (Basic Auth) which is pretty fast, does not include lockouts or authentication delays - however the results may not be much use as often HTTP (Basic Auth) account information is separate from system account databases. The fastest remote service I have found to date is NetBus! Not only is it incredibly quick to authenticate against but a successful password aquisition will yield extreme target penetration.
I still don't get it, what does it do?
Find some service where you need to enter your username and password to gain access, type in a username and password and see what happens, then do it again, and again, and again, and again until you gain access and are positivley authenticated or until you get bored. Pretty straightforward really.
FEATURES
- Support for up to 60 simultaneous sessions
- Fully multi-threaded
- Highly customisable authentication sequences
- Single user mode, User List mode, User/Pass combo mode, Password only mode
- Brute force password mode
- Word list creation/generation/processing
- Import/Export custom services
- Load/Save position
- SOCKS support (with optional authentication)
- Capable of 2500+ authentications/second over high speed connections
SOME TIPS TO GET THE BEST RESULT
DONT use lots of simultaneous connections unless it's beneficial to do so - Usually slow responding targets (like many POP3 servers which have 10 second + failure notification times) are the best candidates.
There are many variables to take into account, connection speed, authentication notification speed, server capacity, even your machine's capacity in some scenarios. Very often you will find less connections will give you more speed...this is important.
DON'T use the keepalive/stayconnected options if you are having problems - it is usually better to troubleshoot these things in one authentication per connection mode.
DO use keepalive/stay connected options if you can -they can greatly increase speed.
DO use positive authentication responses in your custom sequences - they are usually more reliable.
DO take note of the error indicators in the bottom right of the brutus main window -if they are flashing too often then consider changing some settings.
DO use a network sniffer if you can - to understand and troubleshoot authentication sequences to various services. Also consider using netcat or telnet to 'manually' authenticate against a service to see exactly what the server is responding with and what you need to tell it.
DO create custom word lists for your specific targets – If the target user(s) is/are known then create user specific wordlists using the built in password generator. Using target specific lists in conjunction with perhaps a list of common passwords probably offers you the best chance of positive authentication in a reasonable amount of time.
