Hydra
De Linuxmemo.
A very fast network logon cracker which support many different services.
- exemple de commande
hydra -v -V -L users.txt -P passwords.txt -e -n -t 16 127.0.0.1 ftp
- front-end
xhyra
Sommaire |
[modifier] help
Hydra v7.1 (c)2011 by van Hauser/THC & David Maciejak - for legal purposes only
Syntax: hydra [[[-l LOGIN|-L FILE] [-p PASS|-P FILE]] | [-C FILE]] [-e nsr] [-o FILE] [-t TASKS] [-M FILE [-T TASKS]] [-w TIME] [-W TIME] [-f] [-s PORT] [-x MIN:MAX:CHARSET] [-SuvV46] [server service [OPT]]|[service://server[:PORT][/OPT]]
Options:
-R restore a previous aborted/crashed session
-S perform an SSL connect
-s PORT if the service is on a different default port, define it here
-l LOGIN or -L FILE login with LOGIN name, or load several logins from FILE
-p PASS or -P FILE try password PASS, or load several passwords from FILE
-x MIN:MAX:CHARSET password bruteforce generation, type "-x -h" to get help
-e nsr try "n" null password, "s" login as pass and/or "r" reversed login
-u loop around users, not passwords (effective! implied with -x)
-C FILE colon separated "login:pass" format, instead of -L/-P options
-M FILE server list for parallel attacks, one entry per line
-o FILE write found login/password pairs to FILE instead of stdout
-f exit after the first found login/password pair (per host if -M)
-t TASKS run TASKS number of connects in parallel (default: 16)
-w / -W TIME waittime for responses (32s) / between connects per thread
-4 / -6 prefer IPv4 (default) or IPv6 addresses
-v / -V verbose mode / show login+pass combination for each attempt
-U service module usage details
server the target server (use either this OR the -M option)
service the service to crack. Supported protocols: cisco cisco-enable cvs firebird ftp[s] http[s]-{head|get} http[s]-{get|post}-form http-proxy http-proxy-urlenum icq imap irc ldap2 ldap3[-{cram|digest}md5] mssql mysql ncp nntp oracle-listener oracle-sid pcanywhere pcnfs pop3 postgres rdp rexec rlogin rsh sip smb smtp smtp-enum snmp socks5 ssh svn teamspeak telnet vmauthd vnc xmpp
OPT some service modules need special input (use -U to see module help)
hydra -x -h
-x MIN:MAX:CHARSET
MIN is the minimum number of characters in the password
MAX is the maximum number of characters in the password
CHARSET is a specification of the characters to use in the generation
valid CHARSET values are: 'a' for lowercase letters,
'A' for uppercase letters, '1' for numbers, and for all others,
just add their real representation.
Examples:
-x 3:5:a generate passwords from length 3 to 5 with all lowercase letters
-x 5:8:A1 generate passwords from length 5 to 8 with uppercase and numbers
-x 1:3:/ generate passwords from length 1 to 3 containing only slashes
-x 5:5:/%,.- generate passwords with length 5 which consists only of /%,.-
hydra -U
Supported services: asterisk cisco cisco-enable cvs firebird ftp ftps http[s]-{head|get} http[s]-{get|post}-form http-proxy http-proxy-urlenum icq imap[s] irc ldap2[s] ldap3[-{cram|digest}md5][s]
mssql mysql nntp oracle-listener oracle-sid pcanywhere pcnfs pop3[s] postgres rdp rexec rlogin rsh sip smb smtp[s] smtp-enum snmp socks5 ssh sshkey svn teamspeak telnet[s] vmauthd vnc xmpp
[modifier] http[s]-{get|post}-form
http-post-form "<Url du CGI>:<Parametres du Cgi avec ^USER^ et ^PASS^>:F=<Texte a matcher sur la page en cas d'échec>"
hydra -s 80 -V -l admin -P /mnt/bricec_home/mdpcrack/crackstation.txt -t 16 xxx.xxx.xxx.xxx http-post-form "urlDuCgi.cgi:cmd=login&username=^USER^&pwd=^PASS^&port=&f_type=1&f_username=&pre_pwd=^PASS^&ssl_port=1:F=login"
[modifier] Astuces
hydra -o target.log -t 4 -l admin -x 5:8:aA1 -e nsr xxx.xxx.xxx.xxx ssh -V pour voir le progression.
[modifier] Limitation
[ERROR] Maximum number of passwords is 50000000, this file has 120879000 entries.
