Online - Attacking Services
MITRE ATT&CK™ Brute Force - Technique T1110
Theory
Online password attacks target publicly-exposed network services by submitting many passwords or passphrases with the hope of eventually guessing correctly.
Practice
Depending on the target service, different tools can be used
- Hydra (C) can be used against a lot (50+) of services like FTP, HTTP/HTTPs, IMAP, LDAP, MS-SQL, MYSQL, RDP, SMB, SSH and many many more.
- NetExec (Python) can be used against LDAP, WinRM, SMB, SSH and MS-SQL.
- Kerbrute (Go) and smartbrute (Python) can be used against Kerberos pre-authentication.
For brute-force techniques against a specific protocol, you may have a look on the following pages (Network Services) or this page for HTTP/HTTPS.
We may use these tools with a specifically generated wordlists, or using common, default, weak or leaked passwords.