Authentication Cracking

When penetration testers need to access a network service, they can try to obtain valid credentials by using brute force or dictionary attacks.

<aside> 💡 Performing pure brute force attacks over a network are very impractical because of the time needed to run each probe.

</aside>

Such factors include:

• Network latency: in other words, the time needed to transmit information from the penetration tester's machine to the target server and vice versa
• Delays on the attacked service: many services wait some seconds during authentication routines with the scope of making authentication attacks even slower
• Processing time on the attacked server: as in offline attacks, the target server must encrypt and check the credentials

Because of these reasons, network authentication cracking relies almost entirely on dictionary-based attacks

Installing Dictionaries apt install seclists

Authentication Cracking Tools ⇒ Hydra

Hydra is a fast, parallelized, network authentication cracker that supports different protocols. Hydra can attack nearly fifty different service types, including: • FTP • HTTP • IMAP • RDP • SMB • SSH • Telnet

syntax:

hydra-L users.txt -P pass.txt <service://server> <options>

<aside> 📌 Lab

<aside> 📝 Hydra

</aside>

</aside>

Arp poisoning( man in the middle)

What is ARP?

ARP acronym stands for Address Resolution Protocol, and as the name suggests it is a protocol that enables network communications between devices. ARP used to translate Internet Protocol (IP) addresses to a “fixed physical machine address”, also known as a Media Access Control (MAC) address, in a local-area network.

The host is maintaining an ARP cache, and use it to connect to websites and other destinations on the network. However, if host doesn’t have the MAC address for an IP address that looking for, it will ask other machines on the network for a matching MAC address by sending an ARP request packet.