Online - Attacking Services

MITRE ATT&CK™ Brute Force - Technique T1110

Theory

Online password attacks target publicly-exposed network services by submitting many passwords or passphrases with the hope of eventually guessing correctly.

Practice

Depending on the target service, different tools can be used

• Hydra (C) can be used against a lot (50+) of services like FTP, HTTP/HTTPs, IMAP, LDAP, MS-SQL, MYSQL, RDP, SMB, SSH and many many more.

• NetExec (Python) can be used against LDAP, WinRM, SMB, SSH and MS-SQL.

• Kerbrute (Go) and smartbrute (Python) can be used against Kerberos pre-authentication.

For brute-force techniques against a specific protocol, you may have a look on the following pages (Network Services) or this page for HTTP/HTTPS.

We may use these tools with a specifically generated wordlists, or using common, default, weak or leaked passwords.