Cracking FTP with hydra

intro

         Hydra is a fast login cracker that supports a lot of protocols. It is a command line tool, but a GUI is available. The FTP (File Transfer protocol) is used to remotely access files either on a home server or a web server hosted on a web hosting provider. The cracking speed is low but with a weak password and a good wordlist it is possible to be cracked. Most attackers will try to crack a password only if there is no other way in(e.g using an exploit or social engineering).

This is a list of supported protocol that hydra supports as listed in the official website :

Asterisk, AFP, Cisco AAA, Cisco auth, Cisco enable, CVS, Firebird, FTP, HTTP-FORM-GET, HTTP-FORM-POST, HTTP-GET, HTTP-HEAD, HTTP-PROXY, HTTPS-FORM-GET, HTTPS-FORM-POST, HTTP S-GET, HTTPS-HEAD, HTTP-Proxy, ICQ, IMAP, IRC, LDAP, MS-SQL, MYSQL, NCP, NNTP, Oracle Listener, Oracle SID, Oracle, PC-Anywhere, PCNFS, POP3, POSTGRES, RDP, Rexec, Rlogin, Rsh, S7-300, SAP/R3, SIP, SMB, SMTP, SMTP Enum,SNMP, SOCKS5, SSH (v1 and v2), Subversi on, Teamspeak (TS2), Telnet, VMware-Auth, VNC and XMPP.

Disclaimer

          This tutorial is ONLY for educational reasons. Do not misuse this information. I am not responsible for the way you use this knowledge. And remember with great power comes great responsibility.

How to use

syntax :

hydra [OPTIONS] [PROTOCOL & IP]

Basic options:
-l [name] username
-L [wordlist] username wordlist
-p [password] password
-P [wordlist] password wordlist
For more options and help see the man page using :
man hydra

Tutorial

        For this tutorial i have created two Virtual machines one running kali linux (attacker) and the other windows xp (victim), connected to a bridged network.I have file zilla server running on the windows xp device with a weak 4 character user password.
After running a simple nmap scan from the attacker we can see that the victim has port 21 (ftp) open.

Now we can start our attempt to crack the password running the following command :

hydra -l user02 -P pass.txt ftp://192.168.2.3

The 'pass.txt' file is a very small wordlist, in a real world situation a bigger wordlist would be used.

       As you can see above the password was quickly cracked in this case, in a real word scenario it could take from almost instant to never to crack it.
Now we will connect via ftp and download the secret file.

And finally we open the file.

And this is where the tutorial ends.

How to protect your ftp server

         To defend your ftp server you need to block all the possible attack vectors an attacker can use. This is a list of ways to increase your security, but remember that if someone really wants to get in your server he will find a way.

• Keep the ftp server and the host OS updated 
• Use long hard to guess easy to remember passwords 
• Add a login attempt limit 
• If possible set up a whitelist

        After blocking most attack vectors a hacker can still use a zero day exploit or attack the most vulnerable place of the system, the human being using social engineering.

Downloads

Website : https://www.thc.org/thc-hydra/

Kali linux : https://www.kali.org/
Linux : sudo apt-get install hydra hydra-gtk