2

I'm trying to break into my OWN gmail account. But it's not working. Does anyone have any ideas? Is there anything I can do to further isolate the problem? I'm running Kali 2016.1 on virtual box. I'm hardwired directly to my modem with NAT mode turned on in VB. Here is what I tried below.

EDIT: I also changed the -t flag to 1. It may not have liked having 4 request at once. Same results more or less.

hydra -l ********@gmail.com -P passwords.txt -s 465 -S -v -V -t 4 smtp.gmail.com smtp

Now here are the results.

Hydra v8.2 (c) 2016 by van Hauser/THC - Please do not use in military or secret service organizations, or for illegal purposes.

Hydra (http://www.thc.org/thc-hydra) starting at 2016-08-10 16:21:32
[INFO] several providers have implemented cracking protection, check with a small wordlist first - and stay legal!
[WARNING] Google Mail has bruteforce detection and sends false positives. You are not doing anything illegal right?!
[DATA] max 4 tasks per 1 server, overall 64 tasks, 4 login tries (l:1/p:4), ~0 tries per task
[DATA] attacking service smtp on port 465 with SSL
[VERBOSE] Resolving addresses ... done
[ATTEMPT] target smtp.gmail.com - login "********@gmail.com" - pass "aaaa" - 1 of 4 [child 0]
[ATTEMPT] target smtp.gmail.com - login "********@gmail.com" - pass "*******************" - 2 of 4 [child 1]
[ATTEMPT] target smtp.gmail.com - login "********@gmail.com" - pass "jkjh" - 3 of 4 [child 2]
[ATTEMPT] target smtp.gmail.com - login "********@gmail.com" - pass "" - 4 of 4 [child 3]
[VERBOSE] using SMTP LOGIN AUTH mechanism
[VERBOSE] using SMTP LOGIN AUTH mechanism
[VERBOSE] using SMTP LOGIN AUTH mechanism
[VERBOSE] using SMTP LOGIN AUTH mechanism
[STATUS] attack finished for smtp.gmail.com (waiting for children to complete tests)
1 of 1 target completed, 0 valid passwords found
Hydra (http://www.thc.org/thc-hydra) finished at 2016-08-10 16:21:33
  • We can assume that your password is in the password file? And you read the INFO and WARNING messages? I also notice that you did not specify the success conditions in your hydra command. – schroeder Aug 11 '16 at 7:17
  • don't you only have to do that for web authentications? How would you do that for smtp? – user21303 Aug 11 '16 at 9:52
3

What you are doing is a violation of the Gmail Terms of Service. Applicable text:

Don’t misuse our Services. For example, don’t interfere with our Services or try to access them using a method other than the interface and the instructions that we provide. You may use our Services only as permitted by law, including applicable export and re-export control laws and regulations. We may suspend or stop providing our Services to you if you do not comply with our terms or policies or if we are investigating suspected misconduct.

You aren't hacking "your own account." In this case, you are attempting to bypass GMail's authentication system, a service which most assuredly does not belong to you. This is at best a ToS violation and at worst illegal.

  • Is there any service that allows you to test it? I want to be able to do a basic smtp or ftp. I know about DWVA, but that's only useful for web authentication it's all local. I'd prefer to test it over something easier than web. I want to make sure the dang thing is actually working before I start doing more advanced things like ripping POST with Burpsuite. It would also be nice to have the target outside own network for realism's sake. – user21303 Aug 11 '16 at 9:59
  • Buy a Raspberry Pi. Set it up as a LAMP server. Attack it. Learn from your own attacks and harden the server. Rinse, repeat. That's just my opinion though. Then this is a service you actually do control and you won't be filling a Google server's logs with what are clearly brute force attempts. Another alternative is using vagrant to wargame with yourself, google vagrant metasploitable. I wouldn't practice this sort of thing on a GMail production server, ever. – Bradley Evans Aug 11 '16 at 15:25
  • I think I'll just get a Rasberry Pi. In the mean time, just out of curiosity, was there anything I was doing wrong with the initial command. I mean something that was immediately noticeable? I see people do this kind of thing in youtube tutorials all the time. I do literally the exact same commands (and they arn't that hard to understand) with zero luck on admittingly multiple services. Would my modem or ISP play any kind of factor in hydra not working when typing in that command? Is there some kind of config file in Kali I have to mess with? – user21303 Aug 11 '16 at 18:53
  • 6
    You are allowed to "hack" Google under the terms within their bug bounty programme. "Authentication or authorization flaws" is one of the applicable categories. – SilverlightFox Aug 12 '16 at 9:05
3

Download Damn Vulnerable Web Application at this site.

Its awesome and free you can try hack it without consequence. Good luck

Also read up on this and this

I use this type of command

hydra 192.168.88.4 -l admin -P C:\Hydra\List\Passwords\10_million_password_list_top_1000000.txt http-get-form "/dvwa/vulnerabilities/brute/index.php:username=^USER^&password=^PASS^&Login=Login:Username and/or password incorrect.:H=Cookie: security;low;PHPSESSID=Paste ID here"

This is an example line from the DVWA site hack.

-1

No, SMTP of Gmail (like SMTP of any other important email provider) doesn't allow to sign in in this way, in order to avoid brute with software like hydra, medusa etc... Also, Gmail sends false positives like it's also shown in your hydra output, so you will not able to get the correct credentials anyway. Hydra SMTP brute it's only working with non-protected SMTP systems.

  • The SMTP protocol is not the function that is protecting accounts. – schroeder Nov 10 at 14:27
  • It didn't write what you're saying "non-protected SMTP systems" means > SMTP server not protected by firewalls. – Virgula Nov 10 at 17:51
  • "SMTP of Gmail doesn't allow to sign in in this way". This is false. SMTP has nothing to do with the login protection. – schroeder Nov 10 at 22:56
  • @schroeder because protected by a firewall. yes, it's correct. however I didn't see this question was 3 years old, my answer here it's useless. – Virgula Nov 11 at 15:23

protected by Community Nov 11 at 15:25

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.