2.
Hydra
Objective
We are testing how Hydra can guess weak passwords on an FTP server.
Tasks:
- Set up a local FTP server with a weak password.
- Use Hydra to crack it.
- See how fast it works.
Requirements
- Linux (Ubuntu, Kali) or Windows with WSL
- Installed tools:
- vsftpd (FTP server)
- Hydra (password cracking tool)
- A small wordlist like `wordlist.txt`
Setting Up the FTP Server
Step 1: Install vsftpd
sudo apt update
sudo apt install vsftpd -y
Step 2: Configure vsftpd
sudo nano /etc/vsftpd.conf
Make sure these lines exist:
listen=YES
anonymous_enable=NO
local_enable=YES
write_enable=YES
Step 3: Restart vsftpd
sudo systemctl restart vsftpd
sudo systemctl status vsftpd
Step 4: Add a Test User
sudo adduser testuser
sudo passwd testuser
- Username: testuser
- Password: 1234
Step 5: Test FTP Login
ftp 127.0.0.1
# login with testuser / 1234
You should see:
230 Login successful.
4. Make a Wordlist
Create a file `wordlist.txt` with common passwords:
1234
password
admin
test
12345
5. Crack the FTP Password with Hydra
Step 1: Run Hydra
hydra -l testuser -P wordlist.txt ftp://127.0.0.1
- `-l testuser` → username
- `-P wordlist.txt` → password list
- `ftp://127.0.0.1` → FTP server
Step 2: What You’ll See
[DATA] attacking ftp://127.0.0.1:21/
[21][ftp] host: 127.0.0.1 login: testuser password: 1234
Step 3: Time Taken
Since `1234` is first in the list, it usually takes less than 1 second.
Conclusion
- Hydra worked and found the password.
- Simple passwords like `1234` are not safe.
- Always use strong passwords.
