Description: Your task is to crack the password of the user called admin. Use whatever tool you like but we would recommend entering Google and searching for filetype:lst password in order to perform a dictionary attack.
Vulnerability: Dictionary attack
You need to search for ‘filetype:lst password’ and find the .lst file provided by Openwall
The dictionary is located at: http://www.openwall.com/passwords/wordlists/password-2011.lst
What is Dictionary Attack? according to Wikipedia, dictionary attack is a technique for defeating a cipher or authentication mechanism by trying to determine its decryption key or passphrase by trying hundreds or sometimes millions of likely possibilities, such as words in a dictionary.
In this case the web username and password login form, with the user is “admin” and the password is word in filetype:lst dictionary. Ok let’s crack it with hydra, if you are using Kali linux, it should already installed, just fireup hydra in terminal. Before that create a username.txt which contain “admin” and then the password list you can download from http://download.openwall.net/pub/wordlists/passwords/password.gz. Or you can use the password.lst from /usr/share/john/password.lst. First I check the source code for parameter and unsuccessful error message that can be use in hydra paramater, after gather all info, download and extract the file, run the hydra.
hydra -L username.txt -P password.lst ctf.infosecinstitute.com http-post-form "/ctf2/exercises/ex12.php:username=^USER^&password=^PASS^&logIn=login:Incorrect username or password combination" -v
The password is “princess“, let’s try input the password and Login. You pass level 12.
Resources and Tools:
1. Website Hacking 101 – http://resources.infosecinstitute.com/website-hacking-101/
2. Password dictionary – http://download.openwall.net/pub/wordlists/passwords/password.gz
3. Hydra on Kali Linux (run man hydra or hydra –help)