Remote Password Auditing Using THC-Hydra: Or, why brute force/dictionary attacks don't work (often).

THC-Hydra is a remote dictionary attack tool from The Hacker's Choice group. Its a well made tool that supports a lot of protocols and options. The following protocols are supported:
TELNET. FTP. HTTP, HTTPS. HTTP-PROXY, SMB. SMBNT, MS-SQL. MYSQL. REXEC. RSH, RLOGIN, CVS, SNMP, SMTP-AUTH. SOCKS5, VNC, POP3, IMAP. NNTP, PCNFS. ICQ, SAP/R3. LDAP2. LOAP3. Postgres. Teamspeak. Cisco auth. Cisco enable. LDAP2. Cisco AAA
Please don't take anything I say in this tutorial as a slam against THC and their tool, I just think I should point out some of the flaws in using brute force and dictionary attack tools against remote hosts. Their three major negatives are:
1. They are slow because of network latency and bandwidth requirements. Attacks against local password hashes may be fast, but attacking a remote network services can take orders of magnitude longer. If the target has good password policies in place it's unlikely that a brute force password attack will ever work. 2. If there's any sort of logging going on they will be HUGE records of it in the service's logs. Also, any IDS worth its salt is likely to detect the attack. 3. Accounts may be locked out way before the right password is guessed.
With that said, I think Hydra is a tool more suited for the authorized pen tester than it is for an illegal attacker since the pen tester has less to worry about from getting caught. In this first video on THC-Hydra I'll show how to do a simple dictionary attack against a single account.