+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Beginner Hacking (https://hackforums.net/forumdisplay.php?fid=4)
+----- Forum: Hacking Tutorials (https://hackforums.net/forumdisplay.php?fid=47)
+----- Thread: [How To] Kali Linux - Using Medusa to Brute-Force Router Admin Page (/showthread.php?tid=3791802)
[How To] Kali Linux - Using Medusa to Brute-Force Router Admin Page - UltimatePeter - Oct 6, 2013
Medusa is described as a "speedy, massively parallel, modular, login brute-forcer" with modules available to support almost any service that allows remote authentication using a password, including: CVS, FTP, HTTP, IMAP, MS-SQL, MySQL, POP3, PostgreSQL, SMTP-AUTH, Telnet and VNC. Medusa has been designed to run faster than Hydra by using thread-based (rather than Hydra's process-based) parallel testing to attempt to log in to multiple hosts or users concurrently.
HACKER STORE
Medusa 2.0 How-To
Installation
Download medusa-2.0.tar.gz to a suitable directory
Decompress the medusa tarball tar
Code
-zxvf medusa-2.0.tar.gzCode
cd medusa-2.0Code
./configure
make
make installGetting a Wordlist
Put simply, Medusa works by contacting a service, such as a web login or FTP server, and attempting to log in using different usernames and passwords. To test the password strength of a particular user you need a wordlist containing all the passwords you want Medusa to try. You can find free and commercial wordlists at many places on the Internet, including the following:
hugewordlist.txt (35mb)
Open Wall word list collections (500mb)
Outpost 9 wordlists (various)
Packet Storm wordlists (various)
You can also generate your own wordlists by using an existing wordlist and applying "mangling" rules, such as substituting "@" for "a" or adding digits to the start or end of each word. Tools such as the multi-platform open source software John the Ripper allow you to do this. Get it Here
Using Medusa
Medusa is a command-line only tool, so using this open source software is a matter of building up an instruction from the command line. Let's imagine we want Medusa to connect to a network router at IP address 192.168.1.1 using the default username "admin", to test how easy it would be to find the password. To do this, we will use the wordlist hugewordlist.txt (mentioned earlier). Since we know that the router administrator has a dog called Fido and two children called Alice and Bob, it's worth adding these names to the beginning of the hugewordlist.txt textfile, along with the company name, and the top 10 passwords from Rockyou.com
To use Medusa, the following must be specified:
The host "192.168.1.1" to connect to, using the -h switch
The user name "admin" to connect with, using the -u switch
The name of the textfile containing the list of passwords to try, using the -P switch
The module to use for the service we are contacting (in this case http) using the -M switch
So the command we must use is:
Code
medusa -h 192.168.1.1 -u "admin" -P c:/file/directory/hugewordlist.txt -M httpOn my sample network, Medusa was able to test about 2,000 passwords per minute.
What happens if you want to test the passwords of many different users, instead of a single fixed username such as "admin"?
You would load a username file, just like you did a password file.
If Medusa is able to find any passwords, it is wise to check if they conform to your password policy. If so, then your password policy must be tightened. If not, then you may decide to contact the users concerned to highlight the risks of using bad passwords that breach your security policy and ensure that the passwords in question are changed.
More Information on Medusa
To see a list of all the possible switches, simply enter
Code
medusaTo display the service modules are installed, type
Code
medusa -dMore examples of Medusa's command-line options are available, but the best way to learn how use it is simply to download it and start using it.
* - traczthefox - Oct 7, 2013
Nice tutorial Ima have to try this later when I get the chance
* - traczthefox - Oct 8, 2013
Come on people give him some credit for this tutorial.
* - Jagster™ - Oct 8, 2013
seems legit, I might try this on my neighbors later on. Thanks for the Tut OP keep up the good work
* - CreaseAce - Jan 29, 2014
Thanks for the tut op, definitely helped me out.
* - Kaust1k - Feb 12, 2014
This was pretty tight. Definitely taught me something, kudos, and thanks for a great tutorial!
* - cyphex183 - Feb 14, 2014
I have used a few other tools of this nature while testing in my test lab, and I have to say this tutorial is well written!