Hydra It - logon cracker multi-protocolo

[teckV]

THC-Hydra

A very fast network logon cracker which support many different services

para mim o mais poderos login cracker existente... o unico que permite varios processos em paralelo e multi-protocolo... suporta  praticamente todos os protocolos usados nos serviços actuais... HTTPSSH2FTPSMBFTPSAP R3POP3LDAPx... enfim... you name it...

permite criar módulos para protoculos personalizados ou ainda não suportados... nem o céu é o limite.. tu és...

suporta Proxysalgo essencial como é obvio... aconselho a criarem "chains" e iniciarem o processo de um host zombie sob vosso dominio.. considero praticamente impossivel ser detectada a origem

Citação

http-proxy       specifies the page to authentication at (OPTIONAL,

                  default is http://www.suse.com/)

não foi por acaso que já alertei para o facto de as passwords não serem seguras... usem sempre que possviel certificadosespecialmente nos acessos remotos por SSH...

exemplo de comando para craker passwords de sites www/HTTP... na página do directório members no exemplo... o segredo está no molho??? hummm

hydra -l jdoe -P /tmp/passlist www.attack.com http /members/

http://thc.segfault.net/thc-hydra/

readme file

Citação

Number one of the biggest security holes are passwordsas every password security study shows.

Hydra is a parallized login cracker which supports numerous protocols to attack. New modules

are easy to addbeside thatit is flexible and very fast.

Currently this tool supports:

  TELNETFTPHTTPHTTPSHTTP-PROXYSMBSMBNTMS-SQLMYSQLREXEC,

          RSHRLOGINCVSSNMPSMTP-AUTHSOCKS5VNCPOP3IMAPNNTPPCNFS,

          ICQSAP/R3LDAP2LDAP3PostgresTeamspeakCisco authCisco enable,

          LDAP2Cisco AAA (incorporated in telnet module).

This tool is a proof of concept codeto give researchers and security

consultants the possiblity to show how easy it would be to gain unauthorized

access from remote to a system.

[0x02] Disclaimer

1. This tool is for legal purposes only!

2. If this tool is used as part of a commercial service (e.g. pentest),

   nameversion and web address of this tool must be mentioned in the report.

3. If this tool is incorporated into a commercial tool (means: it costs

   moneyhas license costs or upgrade feesetc.) or called by it,

   the nameversion and web address of this tool must be mentioned in the

   report output of the tool. Addtionallya commercial versionkey file,

   etc. must be made available to the author free of charge.

4. Beside 1. to 3. abovethe GPL 2.0 applies.

nas estatisticas podem ver a diferença da utilização de processos paralelos...

1 processo - 23:20

128 processos - 0:55*

cuidado que muitos processos podem "derrubar" o serviçotipo Denial of Service...

Citação

STATISTICS

----------

Run against a SuSE Linux 7.2 on localhost with a "-C FILE" containing

295 entries (294 tries invalid logins1 valid). Every test was run three

times (only for "1 task" just once)and the average noted down.

P A R A L L E L    T A S K S

SERVICE 1 4 8 16 32 50 64 100 128

------- --------------------------------------------------------------------

telnet 23:20 5:58 2:58 1:34 1:05 0:33 0:45* 0:25* 0:55*

ftp 45:54 11:51 5:54 3:06 1:25 0:58 0:46 0:29 0:32

pop3 92:10 27:16 13:56 6:42 2:55 1:57 1:24 1:14 0:50

imap 31:05 7:41 3:51 1:58 1:01 0:39 0:32 0:25 0:21

(*)

Note: telnet timings can be VERY different for 64 to 128 tasks! e.g. with

128 tasksrunning four times resulted in timings between 28 and 97 seconds!

The reason for this is unknown...

guesses per task (rounded up):

295 74 38 19 10 6 5 3 3

guesses possible per connect (depends on the server software and config):

telnet 4

ftp 6

pop3 1

imap 3

teckV

horus herakty