- So, let's start out by covering the easy way
to hack passwords.
Honestly, sometimes it feels like cheating,
but hey, we're hackers, so it doesn't count.
We all know the vendors of software and hardware
many times use default passwords.
And we also know that users of that software and hardware
don't always change their passwords like they should.
As an attacker, we can use that against them.
There are a number of websites out there for instance,
that you can simply search for default passwords,
based on what you're trying to attack.
So, if you're looking for a specific type of router,
you can search for that specific type of router
in that list.
We live in a world where we have to remember
a lot of different passwords.
In fact, if you have a lab environment,
you probably have a ton of devices,
and they all require passwords.
So, one approach is, one password to rule them all, right?
Well that's not really the best way to do things.
The truth is, though most people do use the same password
for websites and devices and computers.
If we can find one password,
we can likely use that on other accounts that they use.
Of course, last but not least the Administrator account.
If we can find the Administrator account for a domain,
we can likely compromise the rest of the computers
on the network.
One of the easiest ways to capture credentials
is actually, just sniffing them right off thin an air.
A perfect example of this is, using hotspot at a hotel
or Starbucks, something like that.
Most of those connections actually,
don't have the security mechanisms built into them,
or enabled to encrypt the traffic between network nodes.
So, what that means is that, once you're connected
to that network, someone can sniff the traffic
of any user that's connected.
So, the next time you're at a public hotspot or hotel,
make sure you're using a VPN.
This is also possible, of course, with physical connections
to the network.
Of course, depending on the switch configuration,
it may be a little bit more difficult,
but there's tools that we can use to get around that.
There are also ways to capture credentials
other than sniffing traffic.
With the man-in-the-middle attack,
you essentially own the traffic that's passing through you,
so you can capture it and pull out the credentials
from that traffic.
There are ways that you can attack encryption
to steal passwords as well.
Obviously, these are more complex type of attacks.
Some of 'em include SSL Certificate Spoofing,
or SSH downgrade and Key Spoofing.
The last thing I'll mention is stealing credentials directly
from a network device.
If you're able to compromise a router or a switch,
or a wireless access point, you essentially own that traffic
and can harvest credentials directly off of that device.
But, if all else fails, you can always brute-force
your way in.
For this we'd need some tools, of course,
there are many tools that can be used
for this type of purpose.
Most of them work by loading in some kind of dictionary
or table of credentials or hashes.
They would then use these credentials that are loaded in,
in an automated way to basically test the credentials
against whatever your target is.
So, it would iterate through that list of credentials
that it has, until it finds one that works.
A few that we mentioned here that I would recommend
are Medusa, THC Hydra, Brutus and of course,
Metaspoit has some great auxiliary modules,
that you can use as well.
You can use brew-forcing for purposes
other than credentials as well.
For instance, there's a tool called Dirbuster,
it's built into Collie Linux
and that's used for discovering directories
and files on Web servers.
It actually uses a dictionary of well known website files
and directories, and again, it iterates through that list
until it finds the ones that actually respond.
Wfuzz is also a great Web application tool.
The first goal of credential attacks,
is to actually identify the valid users,
and then we can attack the passwords.
There's some methods that we can use to enumerate users
over the network.
Some of them simply require you to send a request
to the service, asking for names,
others require more complex methods.
For instance, for SMB/NetBIOS/SAMBA as it's known as,
you can enumerate users in a Window Share
using the Security Accounts Manager
by Brute-forcing the RPC interface.
Metaspoit also includes some tools for this.
One of them is in the auxiliary/scanner/smb module,
the specific modules called smb_enumusers.
And then last but not least, Nmap.
Nmap has tons of scripts as we've said before,
one of them that you can use for this type of attack,
is the snmp_enumusers script.