1. Lab Briefing
🔴 Authorized lab environments only
Only run this against devices and networks you own or have explicit written permission for. Both machines in this briefing belong to the same person on a private lab Wi-Fi. Never reuse the demo password anywhere real.
Network Topology
- Both machines join Wi-Fi "kalirange" → same subnet,
192.168.1.0/24. - ARP is a broadcast — everyone on the subnet can hear it, even on encrypted Wi-Fi.
- Target runs OpenSSH on port 22 — that's the whole attack surface here.
Attack Workflow
Each phase depends on the one before it — skip host discovery and you don't know what to scan; skip enumeration and you don't know SSH is even open.
2. Full Walkthrough
The whole lab — one page.
🔴 Legal
Only run this against devices/networks you own or have written permission for. Both machines here belong to the same person on a private lab Wi-Fi. Never reuse the demo password anywhere real.
Scope & Setup
enable Remote Login on targetsudo systemsetup -setremotelogin onCreate a throwaway test account with a weak demo password (e.g. labuser / Summer2024!). Confirm your own interface with ip a.
Passive Recon
T1040 — Network Sniffingsudo tshark -i wlan0 -f arpListen only — don't touch the target yet. One device announcing itself on ARP is your first lead.
Active Discovery
T1018 — Remote System Discoverynmap -sn 192.168.1.0/24
sudo arp-scan --localnetSweep the subnet to turn the lead into a confirmed IP address.
Service Enumeration
T1046 — Network Service Discoverynmap -sV -p 22,21,80,443 <ip>Confirm SSH (22) is open and get its exact version.
Credential Attack
T1110.001 — Brute Forcehydra -L users.txt -P passwords.txt ssh://<ip>Small hand-built wordlist on purpose. -L/-P = lists; -l/-p = single value.
Gaining Access
T1021.004 — Remote Services: SSHssh labuser@<ip>Cracked credentials → full interactive shell, same as sitting at the keyboard.
Detection
Blue Team reviewlog stream --predicate 'process == "sshd"'Many "Failed password" lines followed by one "Accepted password" = classic brute-force signature.
Flag Reference
| Flag | Meaning |
|---|---|
-sn | Ping sweep only, no port scan — fast host discovery. |
-sV | Version scan — identify the exact service/version behind a port. |
-L / -P | Username/password list files for Hydra (lowercase = single value). |
-t | Hydra's parallel-attempt count — attackers lower it to evade detection. |
3. Feynman Notes
Explain it like I'm five.
> PLAIN-ENGLISH WALKTHROUGH_
Two computers joined the same Wi-Fi, which put them on the same "street" of addresses. We quietly listened first and heard one device introduce itself. We then knocked on every door on that street to get its exact address, asked what services it was running, found a locked door (SSH), and tried a handful of common weak keys until one worked. Once in, we had the exact same access as someone typing at that computer directly. Then we switched hats and checked the security camera (the logs) — and sure enough, the break-in left a very obvious trail.
Everyday Analogies
| Subnet | Everyone living on the same street — shout out the window and the neighbors hear it. |
| ARP broadcast | Shouting "who owns this address?" — anyone on the street can hear the shout. |
| Port | A numbered door on a house. Port 22 is always the SSH door. |
| Brute force | Trying every key on a big keyring until one opens the lock. |
| SSH login | The right key doesn't just open the door — it lets you walk through the whole house. |
| Logs | The security camera that was recording the whole time, whether anyone was watching live or not. |
⭐ IF YOU REMEMBER ONLY 3 THINGS
- SSH keys, not passwords. No password means nothing for Hydra to guess — the single strongest fix.
- fail2ban / sshguard. Auto-bans an IP after a few failed logins, long before a real attack finishes.
- Watch for the pattern. Many failed logins from one IP, then a success, is the universal brute-force signature — in any log, on any OS.
// same attack, same defenses, on any OS — the discipline is the point, not the tool //