did 5 weeks of labs on burp suite as part of my degree but the lecturer massively over complicated everything, I've learned more from this guy and HTB than I have at uni
you are the best teacher loi , really so easy so simple and charismatic i see people look at your videos as movies . keep it up i went to school 10 yrs and never learned as much as 40 minutes watching you !
Yeah, if you setup a profile from a person with stuff like family members, pets and so on, the AI can then use all of those points in passwords attempts if that makes sense
dude why are you the best ?!! the lessons become easyyyyy if you explain it !!! I really enjoyed these 4:29mins and I learned something from you thnx man
This is a basic eye opener. For advanced attacks you have to rotate proxies, have a huge password list, get a good GPU, make api configs to bypass ssl pinning etc. Good though
@@mihaisolomon2893 I do not consider dictionary attacks to be brute force attacks. In order to create a dictionary you purposfully craft strings which are likely to be used by humans. The same logic does not apply to brute force, which is the 'dumbest' form of attacking logins.
True, a dictionary would prove to be useless for unaccounted passwords. It would only work if say make a dictionary from pawned passwords and hope the user haven't change their password. Brute force is different, it will also take longer time since it will account for all possible combinations available for the password. So the step should be > go try register and account and purposely fail password validation in order to get an insight of possible password combinations, like how long is the min max strings, are special characters required, numbers? > then formulate the actual password generator pattern. Also most web apps now have request limiting that further slows down how much request you can send at a particular moment. Definitely will eat days or weeks, you might wanna go to vacation and still find the brute force command not finished by the time you get back.
How realistic is this? To find a username for a website and then use common simple passwords to hack the session? And if it is how can you defend against brute force? Logging IPs and blocking the attack if tried more than 3 times (get the error message) or blocking the whole range of IPS, allowing only some IPs. It will be good enough?
If you run windows you can try using virtual machines. A virtual machine for Kali or parrot and a virtual machine to attack. I was able to find metaspoitable3 in a VM compatible file… it was a bit easier Once you pick VMware or Vbox it will just be a matter of googleing every question and error code you’ll get. Good luck
I think it's about time to switch from passwords with or without MFA to passwordless passkeys, using instead the biometric method to get into phones, tablets, and computers in the first place to access the accounts in question. While using password managers that include MFA on the password manager itself can help, a passkey is preferred as they are the hardest for hackers to hack. It may be to the point that even a password at least 30 characters might no longer be secure enough.
All well and good but most sites implement brute force protection, so this just doesn't work. An alternative would be to just change the response using burp to 302, and direct it to the location you want /admin etc by looking at the source code.
@@jahnyewalker75 to be honest brute force isn't viable these days. This is especially true of ssh logins. Learning these techniques is antiquated and nonsensical tbh. If you want to bypass logins there are plenty of other ways. Studying the source is going to get you far further in accessing data. Plus if you just want to see user A's data, it's much easier to sign up, authenticate as a user and then try a bola attack to see user A's data. Password spraying can also help in getting access so you don't need to sign up. You can also try token forgery ( if you're messing with an api), cookie injection, malicious links.. I mean the list is endless but this video is far from a realistic real world example.
Exactly. This guys full of shit. None of his videos are real world hacking examples. Nothing on UA-cam is a real world hacking example. Xss, sql vuln, nmap etc.. all browsers protect against this type of stuff. The only real world hacking today is social engineering like phishing. Everything else is just for show.
I am from Nepal I love your teaching sir I also want to be like you and contribute for my country because of you I got a chance to learn many many important things you are awesome sirrrr lots of love and support from Nepal
I am facing an error when I open the brusuite internal browser and I turn intercept mode on and try to open my router web page takes forever and still not load when I turn the mode off it worked then after loading the login page I turn the mode on again and put wrong user and password I just won't try to login like the page is stuck but when I turn intercept mode off I work completely fine. Can any one have the same issue please help me
Bien tes vidéos mais ce genre de hack ne peut être fais que si tu as accès au pc distant puisqu'il faut utiliser burpsuit.. Donc ça ne sert pas à grand chose
sir can you please explain and tell me how to use this? POST parameter 'eiin' appears to be 'AND boolean-based blind - WHERE or HAVING clause' injectable (with --string="Password does not Match")
I am not receiving the intercepts after trying to log in with intercept on anyone know what i am doing wrong, the only thing i did different from the video was set up foxyproxy as that is not in the video, however while looking at other videos on how to do that it looks as though mine is similiar
Hey I've done the same thing just as uh did but got no Peculiar result differentiating between the other payloads. I also got some Blank spaces in the Payload Column. Response : 405: Data send in wrong format. Unexpected token u in JSON at position 0. Reason ? Also do a video of Logging in with a Login page having CAPTCHA.
bro! i getting one problem in this video. the problem is when im start attack it is executing a payloads after that it will be showing all payloads are valid. there is no invalid payloads. can you please explain how can i solve it. im waiting for your reply bro.
But, the server's response was saying that the username OR password was wrong. In this case, it would be feasible to do the email enumeration in the application AND THEN carry out your attack
You have the same password as hacker loi?
yes 😂 but of my mobile hotspot
@@shubhamkumar-wn2gj Wait you shouldn't have answered that.
I usually have a password of 3 words in different languages divided by special symbols and the words themselves have "tactical" typos in them.
My Password: 123LoiLiangYangHack456ICanHackNow 😂😂😂😂😂😂
Make video on
How hacker hack firebase data
Ive learned more about burpsuite in this video than I would ever learn in a 20 min tutorial. Keep it up!
Fr i just learned more than most videos ive watched on hacking
dude RTFM
Burp suite and 20 minutes good student
@@creativegamershopnil1879 😂😂😂🤣
did 5 weeks of labs on burp suite as part of my degree but the lecturer massively over complicated everything, I've learned more from this guy and HTB than I have at uni
Finally someone who gets straight at the point u deserve a subscriber
you are the best teacher loi , really so easy so simple and charismatic i see people look at your videos as movies . keep it up i went to school 10 yrs and never learned as much as 40 minutes watching you !
Thank you! 😃
Imagine being caught by a cyber police who saw that intro.
No one can catch me
@@creativegamershopnil1879 What do you use? 🌚
@@likitadevi he uses cmd bruh
@@kanakreshi8467 We can't get caught with cmd? 😳
@@kanakreshi8467 KALI
I don’t learn form you to hack users rather I learn from you to be a great cyber security and dive into hackers mind. Thank you , god bless you.
I've been thinking lately that one could possibly train an AI to learn password patterns to make brute force attempts viable which is a scary thought
Yeah, if you setup a profile from a person with stuff like family members, pets and so on, the AI can then use all of those points in passwords attempts if that makes sense
@@keepyoursins yea training it for a specific target would be especially deadly
@@BarelyGoodTV wanna team up? 👀 Jk
@@keepyoursins lmao
@@martiict350 Nah, he talking about automatic way to do this
dude why are you the best ?!!
the lessons become easyyyyy if you explain it !!!
I really enjoyed these 4:29mins and I learned something from you thnx man
You are the GOAT. The amount of useful knowledge you just crammed into a 5 minute video is beautiful
Setting your password to 1234 is like training self defence for so many years and end up dying because of car accident.
now I get names and stuffs thank you, I'm literally starting my career here with you.
Thank you.
Coders, programmers and hackers will inherit the earth
literally.
@@whoisPremier and gamers
@@whoisPremier and gamers
@@whoisPremier and gamers
Very funny dude
This is a basic eye opener. For advanced attacks you have to rotate proxies, have a huge password list, get a good GPU, make api configs to bypass ssl pinning etc. Good though
Clean and Clear tutorials I ever seen . Thanks lot ..!!!
හැක් කරන්නතෙ හදන්නේ.යසයි බේසික පුටෝ යසයි 🙂👻
thanks for the tut :) But instead of brute force, you actually used a dictionary attack ;)
brute force would have taken longer than video ...
a dictionary attack is still brute force
@@mihaisolomon2893 I do not consider dictionary attacks to be brute force attacks. In order to create a dictionary you purposfully craft strings which are likely to be used by humans. The same logic does not apply to brute force, which is the 'dumbest' form of attacking logins.
True, a dictionary would prove to be useless for unaccounted passwords. It would only work if say make a dictionary from pawned passwords and hope the user haven't change their password.
Brute force is different, it will also take longer time since it will account for all possible combinations available for the password.
So the step should be > go try register and account and purposely fail password validation in order to get an insight of possible password combinations, like how long is the min max strings, are special characters required, numbers? > then formulate the actual password generator pattern.
Also most web apps now have request limiting that further slows down how much request you can send at a particular moment. Definitely will eat days or weeks, you might wanna go to vacation and still find the brute force command not finished by the time you get back.
Awesome video man! Love how you been improving your videos format to a funnier way. keep it up..
Bro love your vibes and enthusiasm.
Just subscribed for sure💯
Would be nice if you made a tutorial literally starting from 0. How to install burpsuite, setup, can it be used on windows etc.
The world's best teacher may God reward you great
What if their password isn't in the list of common passwords
The title of the video literally sais "Bruteforce"... do you know what bruteforcing is?
his videos are always on point and always w8ing like a crazy for the next one!! keep going man1!
I like Your videos a lot man! Funny beginning :D Straight to the point as always!
I brought your Udemy cours .So profesional so cool so stealthy lol.Thanks
i used this program and was hack the bank of america and take 1 trillion of dollars in my account simple like only use this software
thanks for share
You simplified this tutorial with burpsuite i never could get to. Thank you for add tool
the best person for hacking
You Are My Inspiration, Thanks For All The Things Hacker Loi ❤️
The Way You Are Talking Is Just Love
name of books neer him pls
Hi, i wanna chart with you about cyber security can i get your contact or email?
He's videos are sweet. I need student like me to compete with
how do you set the foxy proxy to do that coz when i added it to chrome i only see log in my ip address and options
same
This channel is really very informative and underrated.
hope to see million subscribers soon.
How realistic is this? To find a username for a website and then use common simple passwords to hack the session? And if it is how can you defend against brute force? Logging IPs and blocking the attack if tried more than 3 times (get the error message) or blocking the whole range of IPS, allowing only some IPs. It will be good enough?
love the way you start your video don't say you know hacker Loi 😁
What happened if there is a 2-step verification?
I can’t use any of these tools on my own network to practice or test it. Except wireshark so far. I’ll just stick to learning python 3 for now.
If you run windows you can try using virtual machines.
A virtual machine for Kali or parrot and a virtual machine to attack.
I was able to find metaspoitable3 in a VM compatible file… it was a bit easier
Once you pick VMware or Vbox it will just be a matter of googleing every question and error code you’ll get.
Good luck
I think it's about time to switch from passwords with or without MFA to passwordless passkeys, using instead the biometric method to get into phones, tablets, and computers in the first place to access the accounts in question. While using password managers that include MFA on the password manager itself can help, a passkey is preferred as they are the hardest for hackers to hack. It may be to the point that even a password at least 30 characters might no longer be secure enough.
Brooo you gotta chill man 😅
You have given very good information in terms of security. Thank u
Thanks a lot for your tutorial but most of real world web application has the Rate limit in there login .
All well and good but most sites implement brute force protection, so this just doesn't work. An alternative would be to just change the response using burp to 302, and direct it to the location you want /admin etc by looking at the source code.
Can you elaborate?
@@jahnyewalker75 to be honest brute force isn't viable these days. This is especially true of ssh logins. Learning these techniques is antiquated and nonsensical tbh. If you want to bypass logins there are plenty of other ways. Studying the source is going to get you far further in accessing data. Plus if you just want to see user A's data, it's much easier to sign up, authenticate as a user and then try a bola attack to see user A's data. Password spraying can also help in getting access so you don't need to sign up. You can also try token forgery ( if you're messing with an api), cookie injection, malicious links.. I mean the list is endless but this video is far from a realistic real world example.
But this is not a real world hacking. I mean most of real sites have failed login attemps protection. How do you bypass that ?
Exactly. This guys full of shit. None of his videos are real world hacking examples. Nothing on UA-cam is a real world hacking example. Xss, sql vuln, nmap etc.. all browsers protect against this type of stuff. The only real world hacking today is social engineering like phishing. Everything else is just for show.
@@365hype Do you assume that shit like that would be allowed on UA-cam
How do you handle cases with Burp Suite when there is a login attempt limit?
Can't believe a person can teach burp suite in 5 mts MashaAllah.
I am from Nepal I love your teaching sir I also want to be like you and contribute for my country because of you I got a chance to learn many many important things you are awesome sirrrr lots of love and support from Nepal
It didn’t work for me I am also Nepali btw
I am facing an error when I open the brusuite internal browser and I turn intercept mode on and try to open my router web page takes forever and still not load when I turn the mode off it worked then after loading the login page I turn the mode on again and put wrong user and password I just won't try to login like the page is stuck but when I turn intercept mode off I work completely fine. Can any one have the same issue please help me
Everything is okay but what tools you are using... Please make a video on it🙏🙏
Pleaseee what do you use for that ??
you're a great men ... thank u
I have added the extension of foxyproxy but the burpsuite option isn't showing. Any solution !!??
With burpsuit we get foxyproxy or we have to download it differently, I am really confused in that part, rest is as clear as glass
Sir , show us Admin panel bypass .
And please what kind of browser do you use
Please which browser are you Using
i don't get the part of the terminal. what terminal did he lunched it?
Man you are awesome ! Thank you
Bien tes vidéos mais ce genre de hack ne peut être fais que si tu as accès au pc distant puisqu'il faut utiliser burpsuit.. Donc ça ne sert pas à grand chose
If I switch on burpsuite or foxy proxy the other website im testing goes offline and doesnt respond, any solutions?
My pass is NANJA = NANJABUSINESS 😂😁 Nice video!
if we use in real website login page
withiut owner knowing
what is the result ?are we ethical hacker or not
use your brain for 1 second
@@verbon47 what do u mean??
@@avijeetupadhyaya3885 Ethical
i have a problem with burp suite, and its that it cant load a big dicctionary.... (im triyng with juice shop)
It is only recommend on linux to carry out burpsuite??
When I log in the intercept stays blank
What terminal do you use
can u help me pls? wich abilities do i've to learn for basic CTFs? i need you advice
whats is the extension used and name to add in firefox ???
hi mr loi can you pls show us how to use brute force with hydra ?
like any wepsite .
sir can you please explain and tell me how to use this?
POST parameter 'eiin' appears to be 'AND boolean-based blind - WHERE or HAVING clause' injectable (with --string="Password does not Match")
My question is that if id password not in common password list so what can i do ?
is it possable to get into my gmail saccount using this?
password:
leaveacommentandsubscribe
Burp suite.. is your site running on a local sever..?
I did parallelization but still it is too slow
How to do that on a webpage that locks you out after 4 failed attempts? Also how didi it brute force and where was setup for that?
Sir can we do this in any site or just in bwapp
Thanks a lot for your wonderful tutorials
Do i need deep knowledge about vlan for hacking ?
what if i use login attempt on a lockout address this my help me right ?
I am not receiving the intercepts after trying to log in with intercept on anyone know what i am doing wrong, the only thing i did different from the video was set up foxyproxy as that is not in the video, however while looking at other videos on how to do that it looks as though mine is similiar
Won't this becomes Dos attack if request frequently?
Your Student From India
in going to use this for "educational purposes" only ;)
Dude he is really awesome😭😎😎✌
Awesome bro ❤❤❤
your best of the best man
How can I have the foxyproxy? Any video?
My bwapp doesn't have the right corner tabs for doxy browser 😢
What is with ip blocking? This attack work when the developer records the false login counts from the same ip address?
Hey I've done the same thing just as uh did but got no Peculiar result differentiating between the other payloads. I also got some Blank spaces in the Payload Column. Response : 405: Data send in wrong format. Unexpected token u in JSON at position 0. Reason ?
Also do a video of Logging in with a Login page having CAPTCHA.
Litteraly ANY websites that has a login page?
After avery attempt that going slow down. Any solution?
Is it possible to do this without kali linux?
Hacker loi do u need a terminal to get burpsuite or can u get it on windows 10:)
bro! i getting one problem in this video. the problem is when im start attack it is executing a payloads after that it will be showing all payloads are valid. there is no invalid payloads. can you please explain how can i solve it. im waiting for your reply bro.
But, the server's response was saying that the username OR password was wrong. In this case, it would be feasible to do the email enumeration in the application AND THEN carry out your attack
TBF, he explicitly stated that the attack assumed the username had already been discovered by some means.
Can be used to router page also;
Why does it say Network error when ever I enabled interception
This is called dictionary attack. Not brute force
Sir, I study on few week ago laptop but know they off login in web ... they told study on android phone only plzz help ..
Hey man you should do a coplab with Networkchuck!!!
you didnt explain why foxy proxy is needed or even if
Man your the best ! Bought your course yesterday on udemy pretty excited to start !!!
Does it work the same if the site says enter username or email ?