Hacking on Medium
FBI blames North Korean hackers for the $620 million theft from Axie Infinity
https://cdn-images-1.medium.com/max/840/0*uI2B-pHCjzFcvclw.png
TGIF🤌
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
FBI blames North Korean hackers for the $620 million theft from Axie Infinity
https://cdn-images-1.medium.com/max/840/0*uI2B-pHCjzFcvclw.png
TGIF🤌
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
Medium
🕵🏻FBI blames North Korean hackers for the $620 million theft from Axie Infinity
TGIF🤌
Hacking on Medium
Bypassing UAC Methods and tricks
https://cdn-images-1.medium.com/max/600/1*ysWaNaCDaCV0kKpO_GGtZw.png
Overview :
Continue reading on System Weakness »
___________________________
@hacking_Attack
@Hacking_Video
Bypassing UAC Methods and tricks
https://cdn-images-1.medium.com/max/600/1*ysWaNaCDaCV0kKpO_GGtZw.png
Overview :
Continue reading on System Weakness »
___________________________
@hacking_Attack
@Hacking_Video
Medium
Bypassing UAC Methods and tricks
Overview :
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking Articles|Raj Chandel's Blog
A Detailed Guide on Medusa
Hi Pen testers! Let’s learn about a different tool Medusa, which is intended to be speedy, parallel and modular, login brute forcer. The goal of tool is to support as many services which allow remote authentication as possible. We can consider following items to be some of the key features of the application. a. Thread-based parallel testing. Brute-force testing can be performed against multiple hosts, users or passwords concurrently.b. Flexible user input. Target information (host/user/password) can be specified in a variety of ways. For example, each item can be either a single entry or a file containing multiple entries. Additionally, a combination file format allows the user to refine their target listing.c. Modular design. Each service module exists as an independent .mod file. This means that no modifications are necessary to the core application in order to extend the supported list of services for brute-forcing.Features of Medusa: To get to know detailed description about the options available in Medusa tool just type in “medusa” in kali terminal without any options, it will respectively dump all the available options with their description.Password Cracking for Specific Username:Being a brute forcer, we can use medusa to crack password if username is known on any protocol. For this to work you should have valid username and a file containing passwords to test.Username Cracking for Specific Password:Again, for this you should have a correct password so that you can use brute force to crack the username for ftp by using a file containing list of usernames.___________________________
@hacking_Attack
@Hacking_Video
A Detailed Guide on Medusa
Hi Pen testers! Let’s learn about a different tool Medusa, which is intended to be speedy, parallel and modular, login brute forcer. The goal of tool is to support as many services which allow remote authentication as possible. We can consider following items to be some of the key features of the application. a. Thread-based parallel testing. Brute-force testing can be performed against multiple hosts, users or passwords concurrently.b. Flexible user input. Target information (host/user/password) can be specified in a variety of ways. For example, each item can be either a single entry or a file containing multiple entries. Additionally, a combination file format allows the user to refine their target listing.c. Modular design. Each service module exists as an independent .mod file. This means that no modifications are necessary to the core application in order to extend the supported list of services for brute-forcing.Features of Medusa: To get to know detailed description about the options available in Medusa tool just type in “medusa” in kali terminal without any options, it will respectively dump all the available options with their description.Password Cracking for Specific Username:Being a brute forcer, we can use medusa to crack password if username is known on any protocol. For this to work you should have valid username and a file containing passwords to test.Username Cracking for Specific Password:Again, for this you should have a correct password so that you can use brute force to crack the username for ftp by using a file containing list of usernames.___________________________
@hacking_Attack
@Hacking_Video
Blogspot
A Detailed Guide on Medusa
Hacking Articles is a very interesting blog about information security, penetration testing and vulnerability assessment managed by Raj Chandel.
Hacking Articles Tips Tricks Videos Tutorials
Hacking Articles|Raj Chandel's Blog A Detailed Guide on Medusa Hi Pen testers! Let’s learn about a different tool Medusa, which is intended to be speedy, parallel and modular, login brute forcer. The goal of tool is to support as many services which allow…
h option is used for host, -U option for username file and -p is the password. So basically, you can perform brute force on the username field and can crack the correct username for the password.To crack Login credentials:Now let’s consider a situation where we want to target our host whose username and password both are not known. For this we will brute force both the fields username as well as password by using appropriate options present in medusa.Brute Force on Multiple HostNow let’s consider a different situation, where we have multiple hosts, and we need to crack login credentials for the respective hosts. So, we have created three text files for host, username and password.To attack on specific port than default:Sometimes, network admin may change the port number of a service to another port due to security reasons. So, when performing brute force attack using normal command so it will attack on default port. But we can use -n option so that attack will start on mentioned port rather than default port.Additional password checks (Null/Same)Medusa has a great option -e along with ns which will check [n] null password, [s] same password as username while brute forcing on password field. ___________________________
@hacking_Attack
@Hacking_Video
@hacking_Attack
@Hacking_Video
Hacking Articles Tips Tricks Videos Tutorials
h option is used for host, -U option for username file and -p is the password. So basically, you can perform brute force on the username field and can crack the correct username for the password.To crack Login credentials:Now let’s consider a situation where…
s used in the command so with every username It is trying to match following combination of password with username.To Save Logs in a File: For better readability, record maintenance and future references we can save the output of brute force attack of medusa tool in a different text file. For this we will use parameter -O to save output in text file.Stop on Success: While using above command, the attack will go on though we get correct username and password, this may become tedious when list of username and password is long. To suppress start up Banner:Whenever you run medusa, always a start up banner is displayed. But this tool provides a option to remove the banner by using -b option.Verbose ModeThis tool provides an option for verbose mode. There are in all six verbose level. All messages at or below the specified level will be displayed. The default level is 5. The following is the breakdown of the verbose levels: ___________________________
@hacking_Attack
@Hacking_Video
@hacking_Attack
@Hacking_Video
Hacking Articles Tips Tricks Videos Tutorials
s used in the command so with every username It is trying to match following combination of password with username.To Save Logs in a File: For better readability, record maintenance and future references we can save the output of brute force attack of medusa…
Cox5EVpkmumQ86nBMlN7CzQtoePTb7bdHrLUzUENCCx7Um8eTGXxHYOBGMOxSdFlA/s16000/14.png Error Debug level:This option is used to give detailed description of error. There are 10 error debug level. All messages at or below the specified level will be displayed. The default level is 5.Using Combo Entries: Medusa gives an option of using combo entries while brute forcing. The option -C uses a file containing combo entries. Combo files are colon separated and in the following format: host:user:password. If any of the three fields are left empty, the respective information should be provided either as single global value or as a list in a file. You can use following combinations. Concurrent testing on multiple logins:If you want to perform concurrent testing on multiple logins so for that you use -t option. After that mention the number of logins you want to test concurrently and hence medusa will brute force on respective logins.Display Module Usage Information: You can use a new option -q which will display module's usage information. This should be used in conjunction with the "-M" option.___________________________
@hacking_Attack
@Hacking_Video
@hacking_Attack
@Hacking_Video
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking Articles
A Detailed Guide on Medusa
Hi Pentesters! Let’s learn about a different tool Medusa, which is intended to be a speedy, parallel and modular, login brute forcer. The goal of the tool is to support as many services which allow remote authentication as possible. We can consider the following items to be some of the key features of the application.
1. Thread-based parallel testing. Brute-force testing can be performed against multiple hosts, users or passwords concurrently.
2. Flexible user input. Target information (host/user/password) can be specified in a variety of ways. For example, each item can be either a single entry or a file containing multiple entries. Additionally, a combination file format allows the user to refine their target listing.
3. Modular design. Each service module exists as an independent .mod file. This means that no modifications are necessary to the core application in order to extend the supported list of services for brute-forcing.
in This article will discuss the following options available with Medusa. Table of Contents1. Features of Medusa
2. Password Cracking for specific Username
3. Username Cracking for specific Password
4. To crack login credentials
5. Brute Force on Multiple Host
6. To attack a specific port rather than the default
7. Additional password checks (Null/Same)
8. To Save Logs in a File
9. Stop on Success.
10. To suppress start-up Banner
11. Verbose Mode
12. Error Debug level
13. Using Combo Entries
14. Concurrent testing on multiple logins
15. Display Module Usage Information Features of MedusaTo get to know a detailed description of the options available in the Medusa tool just type in “medusa” in the kali terminal without any options, it will respectively dump all the available options with their description.
Syntax: Medusa [-h host|-H file] [-u username|-U file] [-p password|-P file] [-C file] – 0063M module [OPT]
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi_46Prg76BLUKSMVDBKGlwdmKk0yU1JfjmxtaY2YKAT3P_WS_jRGdRV6HYb7P7Mn4F8kD-5X_8AH8cEW53ncHkY0BVwt14WVDocxLITaMc8MdxSmgcqyERoO2OUwCOORNEcEt-d_2v7tXMDN2NmZDXreedqwOhl5BNoT_KuyR5MhaT3EFEn70mVTBi3w/s16000/1.png?w=640&ssl=1
You can use -d option to dump all the available modules.
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh2NT7tzDOo1UNGO3ZIihPJzwAoonn_DtMPz0EMbgykQDUDn88Kk4hIxb6d-eGaz73Z3NSoazbeICN_UaslV0L-C9AQKxq252xKjANylS4IHP_Zwt70dsgTYwLVrR0S7J02ZR5IpOh_C6BBGx9TNiR7IY-X3M0imsca0JGZazUHlm1uwpmSvQIEaimTyQ/s16000/2_1.png?w=640&ssl=1 Password Cracking for Specific UsernameBeing a brute forcer, we can use medusa to crack passwords if the username is known on any protocol. For this to work you should have a valid username and a file containing passwords to test.
So, for this following command can be used:
medusa -h 192.168.1.141 -u ignite -P pass.txt -M ftp
Here, -h option is for mentioning target ip address, -u option for username and -P for file containing password lists. So this will crack the password for FTP protocol.
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhWZsGOdDxHt63_w-NvBscs3nXUS6r4euegnpCr_Td43V0Zqxzm749LHgnBd9TcF-Ca5_IAO0peuHNRYPj8f_0njfQDPDiAhbKBCY_pBlncutEiywoatBA4ZVXQnqGM6qT639YmiSxY6dTrMQ37zaqMHuyZKroOxaT-_Qjeoxa7ZS948kD6YrkOCs8Tug/s16000/3.png?w=640&ssl=1
So, from the list of passwords, password 123 showed success for username ignite and for ftp login. Username Cracking for Specific PasswordAgain, for this you should have a correct password so that you can use brute force to crack the username for ftp by using a file containing list of usernames.
medusa -h 192.168.1.141 -U users.txt -p 123 -M ftp
Here -h option is used for host, -U option for username file and -p is the password. So basically, you can perform brute force on the username field and can crack the correct username for the password.
https://i0.wp.co[...]
___________________________
@hacking_Attack
@Hacking_Video
A Detailed Guide on Medusa
Hi Pentesters! Let’s learn about a different tool Medusa, which is intended to be a speedy, parallel and modular, login brute forcer. The goal of the tool is to support as many services which allow remote authentication as possible. We can consider the following items to be some of the key features of the application.
1. Thread-based parallel testing. Brute-force testing can be performed against multiple hosts, users or passwords concurrently.
2. Flexible user input. Target information (host/user/password) can be specified in a variety of ways. For example, each item can be either a single entry or a file containing multiple entries. Additionally, a combination file format allows the user to refine their target listing.
3. Modular design. Each service module exists as an independent .mod file. This means that no modifications are necessary to the core application in order to extend the supported list of services for brute-forcing.
in This article will discuss the following options available with Medusa. Table of Contents1. Features of Medusa
2. Password Cracking for specific Username
3. Username Cracking for specific Password
4. To crack login credentials
5. Brute Force on Multiple Host
6. To attack a specific port rather than the default
7. Additional password checks (Null/Same)
8. To Save Logs in a File
9. Stop on Success.
10. To suppress start-up Banner
11. Verbose Mode
12. Error Debug level
13. Using Combo Entries
14. Concurrent testing on multiple logins
15. Display Module Usage Information Features of MedusaTo get to know a detailed description of the options available in the Medusa tool just type in “medusa” in the kali terminal without any options, it will respectively dump all the available options with their description.
Syntax: Medusa [-h host|-H file] [-u username|-U file] [-p password|-P file] [-C file] – 0063M module [OPT]
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi_46Prg76BLUKSMVDBKGlwdmKk0yU1JfjmxtaY2YKAT3P_WS_jRGdRV6HYb7P7Mn4F8kD-5X_8AH8cEW53ncHkY0BVwt14WVDocxLITaMc8MdxSmgcqyERoO2OUwCOORNEcEt-d_2v7tXMDN2NmZDXreedqwOhl5BNoT_KuyR5MhaT3EFEn70mVTBi3w/s16000/1.png?w=640&ssl=1
You can use -d option to dump all the available modules.
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh2NT7tzDOo1UNGO3ZIihPJzwAoonn_DtMPz0EMbgykQDUDn88Kk4hIxb6d-eGaz73Z3NSoazbeICN_UaslV0L-C9AQKxq252xKjANylS4IHP_Zwt70dsgTYwLVrR0S7J02ZR5IpOh_C6BBGx9TNiR7IY-X3M0imsca0JGZazUHlm1uwpmSvQIEaimTyQ/s16000/2_1.png?w=640&ssl=1 Password Cracking for Specific UsernameBeing a brute forcer, we can use medusa to crack passwords if the username is known on any protocol. For this to work you should have a valid username and a file containing passwords to test.
So, for this following command can be used:
medusa -h 192.168.1.141 -u ignite -P pass.txt -M ftp
Here, -h option is for mentioning target ip address, -u option for username and -P for file containing password lists. So this will crack the password for FTP protocol.
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhWZsGOdDxHt63_w-NvBscs3nXUS6r4euegnpCr_Td43V0Zqxzm749LHgnBd9TcF-Ca5_IAO0peuHNRYPj8f_0njfQDPDiAhbKBCY_pBlncutEiywoatBA4ZVXQnqGM6qT639YmiSxY6dTrMQ37zaqMHuyZKroOxaT-_Qjeoxa7ZS948kD6YrkOCs8Tug/s16000/3.png?w=640&ssl=1
So, from the list of passwords, password 123 showed success for username ignite and for ftp login. Username Cracking for Specific PasswordAgain, for this you should have a correct password so that you can use brute force to crack the username for ftp by using a file containing list of usernames.
medusa -h 192.168.1.141 -U users.txt -p 123 -M ftp
Here -h option is used for host, -U option for username file and -p is the password. So basically, you can perform brute force on the username field and can crack the correct username for the password.
https://i0.wp.co[...]
___________________________
@hacking_Attack
@Hacking_Video
Hacking Articles
A Detailed Guide on Medusa
Learn how to use the Medusa brute force tool to crack login credentials, usernames, and passwords with modular and parallel testing.
Hacking Articles Tips Tricks Videos Tutorials
Hacking Articles A Detailed Guide on Medusa Hi Pentesters! Let’s learn about a different tool Medusa, which is intended to be a speedy, parallel and modular, login brute forcer. The goal of the tool is to support as many services which allow remote authentication…
m/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgkUHhaLF92IeeSJACVAK1ZhZjfICjNSYQs_WOOzVzwBoaG2yz6VFsJ_zR5J3HbEjJgtpZxMhHnem0BIez4h7OU-VZbjji89s5Ii-1P6KU25fIb6z34bEKoLP2804CqiGCrvKHSKD8mwRV9ePXUg4ZKMzaLk2tLipjTt0k2SoN8u0n7HgafiFRYbN9uUg/s16000/4.png?w=640&ssl=1 To crack Login credentialsNow let’s consider a situation where we want to target our host whose username and password both are not known. For this we will brute force both the fields username as well as password by using appropriate options present in medusa.
medusa -h 192.168.1.141 -U users.txt -P pass.txt -M ftp
Here we have used -U option for username file, -P option for password file and -h for host name. We have attached a screenshot for your better understanding.
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEifZcM84zu-u9f1kKkycVxXNP7JBZuQGRNOJGKV-yS47PVsWAJuq9KA_6d2zIb7xxCBJbNQBk8A48HJ-TqIjZs9u8oGLtxrUaBdSotcrYwwJEqFK9UaYbqxm2_ovW6ap0VmNseIOqtxCtohTa5wQh777T2HcyXMrIgb9Kb6_L8gX97unxKbmXvUIEXs2g/s16000/5.png?w=640&ssl=1 Brute Force on Multiple HostNow let’s consider a different situation, where we have multiple hosts, and we need to crack login credentials for the respective hosts. So, we have created three text files for host, username and password.
medusa -H hosts.txt -U user.txt -P pass.txt -M ftp
Here, -H option will mention file for host name, -U will mention file for username and -P will mention file for passwords.
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhrwJZWHI4RnK4jmn9GFexbryXFMnqIYcwYFITcjDtsXK5qCOiMV5jUqVGvwNSJyl8HgbkO7dSUeg029COSkeDyyHdo2Eq1G-lESZDAHL8ju7U2kXUZ8Cr1JNN7jvGmVQ50iL5N0n6SHqbDyxLo-cPGBCSSElHqFrdRlVxxdkI2rZHlBr_pkv7lqHbjng/s16000/6.png?w=640&ssl=1
If in case you have multiple hosts and you want to attack on some of the ports concurrently, for that you can use -T option which will brute force on some ports only.
medusa -H hosts.txt -U users.txt -P pass.txt -M ftp -T 1
medusa -H hosts.txt -U users.txt -P pass.txt -M ftp -T 2
The first command will brute force on first host only, but the second will attack on 2 hosts concurrently.
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiY794fFjSYrLa11YBY93-TZnrFlqFFSjaQtkAajICC2YrtaYurRgJK7Sos3aAja5v6hw-l-b3Dx90A-vgmhKROk2PZQNFBC2U7gfkYqgDYGI3K_9e81YEzW795HSzsP9tfJuBvoP2_5JIkZ3BMOU-PJVPRAvciItHlgyDpljQEQ3xF8fsbZl2-dIvz1Q/s16000/7.png?w=640&ssl=1 To attack a specific port than defaultSometimes, the network admin may change the port number of service to another port due to security reasons. So, when performing a brute force attack using normal command so it will attack on default port. But we can use -n option so that attack will start on a mentioned port rather than the default port.
medusa -h 192.168.1.141 -U users.txt -P pass.txt -M ssh
medusa -h 192.168.1.141 -U users.txt -P pass.txt -M ssh -n 2222
Here, in the first command, we are using -h, -U and -M option and ssh service whose default port is 22. But due to security reasons, its port number is changed to 2222 as detected using the nmap scan and first command did not work. So, to launch the attack we used -n option which will specify the specific port number.
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgAzv_rl6on66z9_205-MvQXpnY-x6KucXLnY7NAC2gkn54xbU82LlBq8sHNt07-gNmvZXE_nXi1uFnDNr5ESg-3Of-N_TqciUJfqFug9ZuejG8WsqlQq4Fsi5UD-J3q0TNngnkE6KZSb1v3W15y8A65ZSsqSS4rKPESRK3NDmBQG0XZEm_NHo91Uy2aA/s16000/8.png?w=640&ssl=1 Additional password checks (Null/Same)Medusa has a great option -e along with ns which will check [n] null password, [s] the same password as username while brute forcing on the password field.
medusa -h 192.168.1.141 -u ignite -P pass.txt -M ftp -e ns
Here, as you can observe, -e option is used in the command so with every username It is trying to match the following combination of password with a username.
User: Ignite Password: “ “ as null password.
User: Ignite Password: “Ignite” same as username
https://i0.w[...]
___________________________
@hacking_Attack
@Hacking_Video
medusa -h 192.168.1.141 -U users.txt -P pass.txt -M ftp
Here we have used -U option for username file, -P option for password file and -h for host name. We have attached a screenshot for your better understanding.
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEifZcM84zu-u9f1kKkycVxXNP7JBZuQGRNOJGKV-yS47PVsWAJuq9KA_6d2zIb7xxCBJbNQBk8A48HJ-TqIjZs9u8oGLtxrUaBdSotcrYwwJEqFK9UaYbqxm2_ovW6ap0VmNseIOqtxCtohTa5wQh777T2HcyXMrIgb9Kb6_L8gX97unxKbmXvUIEXs2g/s16000/5.png?w=640&ssl=1 Brute Force on Multiple HostNow let’s consider a different situation, where we have multiple hosts, and we need to crack login credentials for the respective hosts. So, we have created three text files for host, username and password.
medusa -H hosts.txt -U user.txt -P pass.txt -M ftp
Here, -H option will mention file for host name, -U will mention file for username and -P will mention file for passwords.
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhrwJZWHI4RnK4jmn9GFexbryXFMnqIYcwYFITcjDtsXK5qCOiMV5jUqVGvwNSJyl8HgbkO7dSUeg029COSkeDyyHdo2Eq1G-lESZDAHL8ju7U2kXUZ8Cr1JNN7jvGmVQ50iL5N0n6SHqbDyxLo-cPGBCSSElHqFrdRlVxxdkI2rZHlBr_pkv7lqHbjng/s16000/6.png?w=640&ssl=1
If in case you have multiple hosts and you want to attack on some of the ports concurrently, for that you can use -T option which will brute force on some ports only.
medusa -H hosts.txt -U users.txt -P pass.txt -M ftp -T 1
medusa -H hosts.txt -U users.txt -P pass.txt -M ftp -T 2
The first command will brute force on first host only, but the second will attack on 2 hosts concurrently.
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiY794fFjSYrLa11YBY93-TZnrFlqFFSjaQtkAajICC2YrtaYurRgJK7Sos3aAja5v6hw-l-b3Dx90A-vgmhKROk2PZQNFBC2U7gfkYqgDYGI3K_9e81YEzW795HSzsP9tfJuBvoP2_5JIkZ3BMOU-PJVPRAvciItHlgyDpljQEQ3xF8fsbZl2-dIvz1Q/s16000/7.png?w=640&ssl=1 To attack a specific port than defaultSometimes, the network admin may change the port number of service to another port due to security reasons. So, when performing a brute force attack using normal command so it will attack on default port. But we can use -n option so that attack will start on a mentioned port rather than the default port.
medusa -h 192.168.1.141 -U users.txt -P pass.txt -M ssh
medusa -h 192.168.1.141 -U users.txt -P pass.txt -M ssh -n 2222
Here, in the first command, we are using -h, -U and -M option and ssh service whose default port is 22. But due to security reasons, its port number is changed to 2222 as detected using the nmap scan and first command did not work. So, to launch the attack we used -n option which will specify the specific port number.
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgAzv_rl6on66z9_205-MvQXpnY-x6KucXLnY7NAC2gkn54xbU82LlBq8sHNt07-gNmvZXE_nXi1uFnDNr5ESg-3Of-N_TqciUJfqFug9ZuejG8WsqlQq4Fsi5UD-J3q0TNngnkE6KZSb1v3W15y8A65ZSsqSS4rKPESRK3NDmBQG0XZEm_NHo91Uy2aA/s16000/8.png?w=640&ssl=1 Additional password checks (Null/Same)Medusa has a great option -e along with ns which will check [n] null password, [s] the same password as username while brute forcing on the password field.
medusa -h 192.168.1.141 -u ignite -P pass.txt -M ftp -e ns
Here, as you can observe, -e option is used in the command so with every username It is trying to match the following combination of password with a username.
User: Ignite Password: “ “ as null password.
User: Ignite Password: “Ignite” same as username
https://i0.w[...]
___________________________
@hacking_Attack
@Hacking_Video
Hacking Articles Tips Tricks Videos Tutorials
m/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgkUHhaLF92IeeSJACVAK1ZhZjfICjNSYQs_WOOzVzwBoaG2yz6VFsJ_zR5J3HbEjJgtpZxMhHnem0BIez4h7OU-VZbjji89s5Ii-1P6KU25fIb6z34bEKoLP2804CqiGCrvKHSKD8mwRV9ePXUg4ZKMzaLk2tLipjTt0k2SoN8u0n7HgafiFRYbN9uUg/s16000/4.png?w=640&ssl=1…
p.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgQnSUpAz8c4nijYS9VVvMnACTGm6h-CI4lErcUjd8JSCmb5SqviD_DOkruT-wMYsdqbEmRh9is7nWD0nH6hMpHrVVOkpzSa4S2KS4H-M52fIwdz5yut8wqCeOVDlu7nU5cdKhjHyKjDGw9Kzo8Y6WskgSnjJ31UW4MuI-rCGGbiGxh_5949mjhAMDZ5g/s16000/9.png?w=640&ssl=1 To Save Logs in a FileFor better readability, record maintenance and future references we can save the output of the brute force attack of the medusa tool in a different text file. For this, we will use parameter -O to save output in text file.
medusa -h 192.168.1.141 -u ignite -P pass.txt -M ftp -O log.txt
Here, again the command is the same we have just added a new parameter -O to store the logs in text file log.txt. Then to ensure whether the output is stored in file, we have opened it using cat command. And the result shows the desired output.
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh3GlyWtvkUoUzE2CYBgsv3RroyPxXDW6NGDAkRatK5wJBsHjL-ZALh6NmbTFg8Yklylb7qhZrO-i4uqrtZfjxg4oSgOftDsC_ZMN5Cql6UMDIbcXCI7AdWMgDC_bBDWR5aBGV0xFlUeB9G1MT76HvKKFrNqvofv4AYRRhSIC6N5xDN6xo-TsACA5yIhQ/s16000/10.png?w=640&ssl=1 Stop on SuccessWhile using the above command, the attack will go on though we get the correct username and password, this may become tedious when the list of usernames and password is long.
So, to save from this medusa provides some options.
medusa -H hosts.txt -U users.txt -P pass.txt -M ftp -f
medusa -H hosts.txt -U users.txt -P pass.txt -M ftp -F
Above in the first command as you can observe -f option is used so that will stop scanning host after first valid username/password found.
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjBnA1dkIHkeWpSURIO8PGwRnOa535SPfX7eocfrEWF0dWHbjcCBHK2vpEkkIYaSUo_--EeAZc9bLawsfyPq0DyaDgYm8DnXidNvkadLjfuo1c2xv3UqWUCnNWW6brasGicSfB7hY0Wch1Lzi-9dUERuK4UcKeBPa6oTP-KVG_dOMpCdKP1pf6HAjQULg/s16000/11.png?w=640&ssl=1
And in the second command, -F option is used that will stop audit after first valid username/password found on any host.
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhihbTdZkdC9Q6qScufTvXMdO2FWlhnHo5hHjn3zCH-eTifUFw-aFMQZPDVEBOE_MrhgkdbibllD10fJjVne8g4RgjnZR_qK-xPTuZhkMUPHLkMmkI18kONibXblYEe46g_MAul53O39a5eMByvc2MgSWu_pJnenUTEfcniNnHZxfBqEptg5XfQO3-ljw/s16000/12.png?w=640&ssl=1 To suppress start-up BannerWhenever you run medusa, always a start up banner is displayed. But this tool provides an option to remove the banner by using -b option.
medusa -h 192.168.1.141 -U users.txt -P pass.txt -M ftp -b
As in the screenshot displays, after applying -b option, the banner is suppressed.
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhjeaNJnIbhXE_F-FeDwG4ma3-Gz8f54uJEKjG1wRea2BDCXZDV3R6eKxPwCY2LthboCydg-Jeum55lGjsMdpQNE7GuxPzihDvj_cKRGhJxApSmMlO8gu_AeKfLBchBa6tr5yECIap38Zm49tbRjR81UMCl-yNv7qeBed3R9IVszUZnBqQQLt5Jdue76w/s16000/13.png?w=640&ssl=1 Verbose ModeThis tool provides an option for verbose mode. There are in all six verbose level. All messages at or below the specified level will be displayed. The default level is 5. The following is the breakdown of the verbose levels:
0)EXIT APPLICATION 1)MESSAGE WITHOUT TAG 2)LOG MESSAGE WITHOUT TAG 3)IMPORTANT MESSAGE 4)ACCOUNT FOUND 5)ACCOUNT 6)CHECK GENERAL MESSAGE
medusa -H hosts.txt -U users.txt -P pass.txt -M ftp -v
medusa -H hosts.txt -U users.txt -P pass.txt -M ftp -v 6
Here, in the given commands, verbose level 5 and level 6 is used. Level 5 performs account check and level 6 displays general message also.
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgp8M0Bq0jVy6NWhNmsRnZe8vtGRyGjFhrnH_72rkPXuZSiF4ya1Q8IX__kQkyq1yIYWdEF9aZ2-u8dUYAagqDZ0bowSRhZKhqoVRUyE0mJS5dNZE3TGzcbNOBJOCox5EVpkmumQ86nBMlN7CzQtoePTb7bdHrLUzUENCCx7Um8eTGXxHYOBGMOxSdFlA/s16000/14.png?w=640&ssl=1 Error Debug levelThis option is used to give detailed description of error. There are 10 error debug level. All messages at or below the specified level will be displayed.[...]
___________________________
@hacking_Attack
@Hacking_Video
medusa -h 192.168.1.141 -u ignite -P pass.txt -M ftp -O log.txt
Here, again the command is the same we have just added a new parameter -O to store the logs in text file log.txt. Then to ensure whether the output is stored in file, we have opened it using cat command. And the result shows the desired output.
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh3GlyWtvkUoUzE2CYBgsv3RroyPxXDW6NGDAkRatK5wJBsHjL-ZALh6NmbTFg8Yklylb7qhZrO-i4uqrtZfjxg4oSgOftDsC_ZMN5Cql6UMDIbcXCI7AdWMgDC_bBDWR5aBGV0xFlUeB9G1MT76HvKKFrNqvofv4AYRRhSIC6N5xDN6xo-TsACA5yIhQ/s16000/10.png?w=640&ssl=1 Stop on SuccessWhile using the above command, the attack will go on though we get the correct username and password, this may become tedious when the list of usernames and password is long.
So, to save from this medusa provides some options.
medusa -H hosts.txt -U users.txt -P pass.txt -M ftp -f
medusa -H hosts.txt -U users.txt -P pass.txt -M ftp -F
Above in the first command as you can observe -f option is used so that will stop scanning host after first valid username/password found.
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjBnA1dkIHkeWpSURIO8PGwRnOa535SPfX7eocfrEWF0dWHbjcCBHK2vpEkkIYaSUo_--EeAZc9bLawsfyPq0DyaDgYm8DnXidNvkadLjfuo1c2xv3UqWUCnNWW6brasGicSfB7hY0Wch1Lzi-9dUERuK4UcKeBPa6oTP-KVG_dOMpCdKP1pf6HAjQULg/s16000/11.png?w=640&ssl=1
And in the second command, -F option is used that will stop audit after first valid username/password found on any host.
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhihbTdZkdC9Q6qScufTvXMdO2FWlhnHo5hHjn3zCH-eTifUFw-aFMQZPDVEBOE_MrhgkdbibllD10fJjVne8g4RgjnZR_qK-xPTuZhkMUPHLkMmkI18kONibXblYEe46g_MAul53O39a5eMByvc2MgSWu_pJnenUTEfcniNnHZxfBqEptg5XfQO3-ljw/s16000/12.png?w=640&ssl=1 To suppress start-up BannerWhenever you run medusa, always a start up banner is displayed. But this tool provides an option to remove the banner by using -b option.
medusa -h 192.168.1.141 -U users.txt -P pass.txt -M ftp -b
As in the screenshot displays, after applying -b option, the banner is suppressed.
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhjeaNJnIbhXE_F-FeDwG4ma3-Gz8f54uJEKjG1wRea2BDCXZDV3R6eKxPwCY2LthboCydg-Jeum55lGjsMdpQNE7GuxPzihDvj_cKRGhJxApSmMlO8gu_AeKfLBchBa6tr5yECIap38Zm49tbRjR81UMCl-yNv7qeBed3R9IVszUZnBqQQLt5Jdue76w/s16000/13.png?w=640&ssl=1 Verbose ModeThis tool provides an option for verbose mode. There are in all six verbose level. All messages at or below the specified level will be displayed. The default level is 5. The following is the breakdown of the verbose levels:
0)EXIT APPLICATION 1)MESSAGE WITHOUT TAG 2)LOG MESSAGE WITHOUT TAG 3)IMPORTANT MESSAGE 4)ACCOUNT FOUND 5)ACCOUNT 6)CHECK GENERAL MESSAGE
medusa -H hosts.txt -U users.txt -P pass.txt -M ftp -v
medusa -H hosts.txt -U users.txt -P pass.txt -M ftp -v 6
Here, in the given commands, verbose level 5 and level 6 is used. Level 5 performs account check and level 6 displays general message also.
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgp8M0Bq0jVy6NWhNmsRnZe8vtGRyGjFhrnH_72rkPXuZSiF4ya1Q8IX__kQkyq1yIYWdEF9aZ2-u8dUYAagqDZ0bowSRhZKhqoVRUyE0mJS5dNZE3TGzcbNOBJOCox5EVpkmumQ86nBMlN7CzQtoePTb7bdHrLUzUENCCx7Um8eTGXxHYOBGMOxSdFlA/s16000/14.png?w=640&ssl=1 Error Debug levelThis option is used to give detailed description of error. There are 10 error debug level. All messages at or below the specified level will be displayed.[...]
___________________________
@hacking_Attack
@Hacking_Video
Hacking Articles Tips Tricks Videos Tutorials
p.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgQnSUpAz8c4nijYS9VVvMnACTGm6h-CI4lErcUjd8JSCmb5SqviD_DOkruT-wMYsdqbEmRh9is7nWD0nH6hMpHrVVOkpzSa4S2KS4H-M52fIwdz5yut8wqCeOVDlu7nU5cdKhjHyKjDGw9Kzo8Y6WskgSnjJ31UW4MuI-rCGGbiGxh_5949mjhAMDZ5g/s16000/9.png?w=640&ssl=1…
The default level is 5.
The following is the breakdown of the error levels:
0: FATAL
1: ALERT
2: CRITICAL
3: ERROR
4: WARNING
5: NOTICE
6: INFO
7: DEBUG
8: DEBUG-AUDIT
9: DEBUG- SERVER
10: DEBUG – MODULE
medusa -h 192.168.1.141 -U users.txt -P pass.txt -M ftp -w 0
medusa -h 192.168.1.141 -U users.txt -P pass.txt -M ftp -w 06
medusa -h 192.168.1.141 -U users.txt -P pass.txt -M ftp -w 07
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiTPQb2w7vwj-4w9iVrex24-EERAxUHDhX8y6tB4zZyKN9GOaWny74GB-_4QIfhahuk4ocbqQOO2-kVPJfZ-AMIhvdLH9u2ChWoQiYeCEp6MgAN_ZNIfHnp4dYK37auWFMqYk3Hn34sKdL1hTxz2_N_lYdlWC1yDSZGU2nPSSPUdJS0mA17LSvl6QKj7A/s16000/15.png?w=640&ssl=1 Using Combo EntriesMedusa gives an option of using combo entries while brute forcing. The option -C uses a file containing combo entries. Combo files are colon separated and in the following format: host:user:password. If any of the three fields are left empty, the respective information should be provided either as single global value or as a list in a file. You can use following combinations.
host:user:password
host:user:
host::
username:password
username:
password
host::username
medusa -M ftp -C userpass.txt
So here first userpass.txt file is created where data is stored in form of host:username:password. And then medusa brute force attack is performed using -C option. You can take reference from screenshot attached.
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgfGBlp7sZPZWGYx1TymPzeheLobq38-ANeKK6E0sFpCKOIibdprCK3hihkQbXyEBixkqXG9hI_SHQzlZ8GSG0XEd_TkGQx8b2e0z5ctdOaKEDR2QmEtlLY6HOIcEq5hnUPuQMSSjOU4F_wHMjB8WWx11aTh3mr2VwoPnSRyNw8yPt-xYg6_gE-_j1x9A/s16000/16.png?w=640&ssl=1 Concurrent testing on multiple loginsIf you want to perform concurrent testing on multiple logins so for that you use -t option. After that mention the number of logins you want to test concurrently and hence medusa will brute force on respective logins.
medusa -h 192.168.1.141 -U users.txt -P pass.txt -M ftp -t 4
So, while performing the attack it tested concurrently 4 logins at specified port and printed results for all four concurrently.
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEixT7WOCJbo2eYBwqrq3b2XLusdplUnxqyli5K1QiEvm3QzEtWcEl1sQ0Yi1bWzc8sqZrJX8eRMefoJNydxUFXkXSW2dnz9KsxCmJckHr_gph6LloAkTJPDkadyKf9Vm33E2R1nNsrXo_AG_hMichWqXIdQCRNfJp3bS6F3VV7Q7b2nt_EdtUH-OFMkaw/s16000/17.png?w=640&ssl=1 Display Module Usage InformationYou can use a new option -q which will display module’s usage information. This should be used in conjunction with the “-M” option.
medusa -h 192.168.1.141 -U users.txt -P pass.txt -M ftp -q
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiEL2iiRp_sGmZIQfcLVD0ZF_s6QxZNPyn9KBT6-cqeeh5xO0lghWVGfEs-4r2gwnKeMMO123MtWtoW15vW6BE7XX44TtYs5rgVnoMk4hsnxv2gWN8h9N4krue7tffr2Ra5Qb8fXvw82pv77tstT2GFS7qpAzBsvc7Qf1ntDJX4uiA6VJFtd-k6zZph_Q/s16000/18.png?w=640&ssl=1
Author: Divya Adwani is a researcher and technical writer who is very much keen to learn and enthusiastic to learn ethical hacking Contact here
The post A Detailed Guide on Medusa appeared first on Hacking Articles.
___________________________
@hacking_Attack
@Hacking_Video
The following is the breakdown of the error levels:
0: FATAL
1: ALERT
2: CRITICAL
3: ERROR
4: WARNING
5: NOTICE
6: INFO
7: DEBUG
8: DEBUG-AUDIT
9: DEBUG- SERVER
10: DEBUG – MODULE
medusa -h 192.168.1.141 -U users.txt -P pass.txt -M ftp -w 0
medusa -h 192.168.1.141 -U users.txt -P pass.txt -M ftp -w 06
medusa -h 192.168.1.141 -U users.txt -P pass.txt -M ftp -w 07
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiTPQb2w7vwj-4w9iVrex24-EERAxUHDhX8y6tB4zZyKN9GOaWny74GB-_4QIfhahuk4ocbqQOO2-kVPJfZ-AMIhvdLH9u2ChWoQiYeCEp6MgAN_ZNIfHnp4dYK37auWFMqYk3Hn34sKdL1hTxz2_N_lYdlWC1yDSZGU2nPSSPUdJS0mA17LSvl6QKj7A/s16000/15.png?w=640&ssl=1 Using Combo EntriesMedusa gives an option of using combo entries while brute forcing. The option -C uses a file containing combo entries. Combo files are colon separated and in the following format: host:user:password. If any of the three fields are left empty, the respective information should be provided either as single global value or as a list in a file. You can use following combinations.
host:user:password
host:user:
host::
username:password
username:
password
host::username
medusa -M ftp -C userpass.txt
So here first userpass.txt file is created where data is stored in form of host:username:password. And then medusa brute force attack is performed using -C option. You can take reference from screenshot attached.
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgfGBlp7sZPZWGYx1TymPzeheLobq38-ANeKK6E0sFpCKOIibdprCK3hihkQbXyEBixkqXG9hI_SHQzlZ8GSG0XEd_TkGQx8b2e0z5ctdOaKEDR2QmEtlLY6HOIcEq5hnUPuQMSSjOU4F_wHMjB8WWx11aTh3mr2VwoPnSRyNw8yPt-xYg6_gE-_j1x9A/s16000/16.png?w=640&ssl=1 Concurrent testing on multiple loginsIf you want to perform concurrent testing on multiple logins so for that you use -t option. After that mention the number of logins you want to test concurrently and hence medusa will brute force on respective logins.
medusa -h 192.168.1.141 -U users.txt -P pass.txt -M ftp -t 4
So, while performing the attack it tested concurrently 4 logins at specified port and printed results for all four concurrently.
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEixT7WOCJbo2eYBwqrq3b2XLusdplUnxqyli5K1QiEvm3QzEtWcEl1sQ0Yi1bWzc8sqZrJX8eRMefoJNydxUFXkXSW2dnz9KsxCmJckHr_gph6LloAkTJPDkadyKf9Vm33E2R1nNsrXo_AG_hMichWqXIdQCRNfJp3bS6F3VV7Q7b2nt_EdtUH-OFMkaw/s16000/17.png?w=640&ssl=1 Display Module Usage InformationYou can use a new option -q which will display module’s usage information. This should be used in conjunction with the “-M” option.
medusa -h 192.168.1.141 -U users.txt -P pass.txt -M ftp -q
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiEL2iiRp_sGmZIQfcLVD0ZF_s6QxZNPyn9KBT6-cqeeh5xO0lghWVGfEs-4r2gwnKeMMO123MtWtoW15vW6BE7XX44TtYs5rgVnoMk4hsnxv2gWN8h9N4krue7tffr2Ra5Qb8fXvw82pv77tstT2GFS7qpAzBsvc7Qf1ntDJX4uiA6VJFtd-k6zZph_Q/s16000/18.png?w=640&ssl=1
Author: Divya Adwani is a researcher and technical writer who is very much keen to learn and enthusiastic to learn ethical hacking Contact here
The post A Detailed Guide on Medusa appeared first on Hacking Articles.
___________________________
@hacking_Attack
@Hacking_Video
Stored XSS, SQL, IDOR and Hall Of Fames
Hello, today I am going to be writing about how I found stored XSS, reflected XSS, SQL and IDOR all within a software that was in scope…Continue reading on Medium »
Read more...
Hello, today I am going to be writing about how I found stored XSS, reflected XSS, SQL and IDOR all within a software that was in scope…Continue reading on Medium »
Read more...
Mining Liquidity for Bug Bounty Contribution
https://hatsfinance.medium.com/mining-liquidity-for-bug-bounty-contribution-bfc6f4b22525?source=rss------bug_bounty-5
___________________________
@hacking_Attack
@Hacking_Video
https://hatsfinance.medium.com/mining-liquidity-for-bug-bounty-contribution-bfc6f4b22525?source=rss------bug_bounty-5
___________________________
@hacking_Attack
@Hacking_Video
Medium
Mining Liquidity for Bug Bounty Contribution
Hats Finance is excited to introduce Protocol Protection Mining starting in Q2 2022, allowing anyone in the ecosystem to become a protector…
Hats Finance is excited to introduce Protocol Protection Mining starting in Q2 2022, allowing anyone in the ecosystem to become a…Continue reading on Medium » (https://hatsfinance.medium.com/mining-liquidity-for-bug-bounty-contribution-bfc6f4b22525?source=rss------bug_bounty-5)
___________________________
@hacking_Attack
@Hacking_Video
___________________________
@hacking_Attack
@Hacking_Video
Medium
Mining Liquidity for Bug Bounty Contribution
Hats Finance is excited to introduce Protocol Protection Mining starting in Q2 2022, allowing anyone in the ecosystem to become a protector…
Stored XSS, SQL, IDOR and Hall Of Fames
https://medium.com/@tobydavenn/stored-xss-sql-idor-and-hall-of-fames-938fbcf479b8?source=rss------bug_bounty-5
___________________________
@hacking_Attack
@Hacking_Video
https://medium.com/@tobydavenn/stored-xss-sql-idor-and-hall-of-fames-938fbcf479b8?source=rss------bug_bounty-5
___________________________
@hacking_Attack
@Hacking_Video
Medium
Stored XSS, SQL, IDOR and Hall Of Fames
Hello, today I am going to be writing about how I found stored XSS, reflected XSS, SQL and IDOR all within a software that was in scope for…
Hello, today I am going to be writing about how I found stored XSS, reflected XSS, SQL and IDOR all within a software that was in scope…Continue reading on Medium » (https://medium.com/@tobydavenn/stored-xss-sql-idor-and-hall-of-fames-938fbcf479b8?source=rss------bug_bounty-5)
___________________________
@hacking_Attack
@Hacking_Video
___________________________
@hacking_Attack
@Hacking_Video
Medium
Stored XSS, SQL, IDOR and Hall Of Fames
Hello, today I am going to be writing about how I found stored XSS, reflected XSS, SQL and IDOR all within a software that was in scope for…
hacking: security in practice
how to control mobile through kali
As the title says how to control someone mobile without installing the oblivious app and giving permission like blind is there any way to do it without other getting know?
submitted by /u/ujjwalus7
[link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
how to control mobile through kali
As the title says how to control someone mobile without installing the oblivious app and giving permission like blind is there any way to do it without other getting know?
submitted by /u/ujjwalus7
[link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
reddit
how to control mobile through kali
As the title says how to control someone mobile without installing the oblivious app and giving permission like blind is there any way to do it...
hacking: security in practice
Find someone from California.
How can I find someone from California by an approximation of the birthday date and last name? I'm tring to find a friend I had but lost contact with, I know this isn't exactly hacking but I need help and didn't knew where to ask. Is there any official site that shows that information or something else I can use?
submitted by /u/Psycho0075
[link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
Find someone from California.
How can I find someone from California by an approximation of the birthday date and last name? I'm tring to find a friend I had but lost contact with, I know this isn't exactly hacking but I need help and didn't knew where to ask. Is there any official site that shows that information or something else I can use?
submitted by /u/Psycho0075
[link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
reddit
Find someone from California.
How can I find someone from California by an approximation of the birthday date and last name? I'm tring to find a friend I had but lost contact...