TechKnowSurge
TechKnowSurge Catalog Videos DEMO: Credential Stuffing
VideoSecurityFree

DEMO: Credential Stuffing

Credential stuffing is an attack technique that uses stolen username and password pairs to gain unauthorized access to systems. This content covers how the attack works and demonstrates it using Hydra on a Kali Linux machine against an FTP target.

⚑ Complete this video to capture a CTF flag worth 1 point.

About this video

Credential stuffing is a targeted attack technique that leverages stolen credential databases to attempt unauthorized access to systems. Rather than generating random username and password guesses, an attacker uses real pairs obtained from previous breaches, banking on the likelihood that users have reused those credentials across multiple platforms. Because large collections of compromised credentials are freely available on the internet, this type of attack requires minimal technical sophistication and can be executed by nearly anyone with access to the right tools and data. HaveIBeenPwned.com is one widely used resource that aggregates data from known breaches, allowing individuals to check whether their email address and associated account information have been exposed. If an email account has been used across multiple services over an extended period, the chances are high that at least one of those services has suffered a breach, leaving usernames, passwords, or other identifying information accessible to adversaries. From a practical standpoint, the attack is demonstrated using Hydra on a Kali Linux system against an FTP host. A credential file containing matched username and password pairs is passed to Hydra using the capital C flag, and the tool runs through each combination sequentially without mixing or cross-referencing entries. In the demonstration, all three credential pairs in the file successfully authenticate against the target, though in a real-world scenario an attacker needs only a single successful match to establish access. This underscores why credential stuffing remains a highly effective and frequently used method in modern threat campaigns.

What you'll learn

What's covered

Credential Stuffing

Key terms

Brute Force Attack
An attack method that systematically tries all possible combinations of passwords or keys until the correct one is found.
Authentication
The process of verifying the identity of a user, device, or system.
Credential Stuffing
An automated attack in which stolen username and password pairs from one breached service are systematically tested against other services to gain unauthorized access. It exploits users who reuse passwords across multiple accounts.
Dictionary Attack
A type of brute force attack that uses a predefined list of common words and phrases to guess passwords.
Exploit
A piece of software or technique that takes advantage of a vulnerability to gain unauthorized access or cause harm.

Topics

Credential Stuffing Ethical Hacking Hydra Kali Linux Ftp Cybersecurity Identity And Access Management

Transcript

Another type of attack is credential stuffing. Just a reminder that this is for ethical hacking purposes only. Don't use this for any illegal, malicious, or unethical activities.

What credential stuffing is

There are times when an adversary will get a hold of a list of usernames and passwords, so they know what the usernames and passwords are. Maybe they don't know if the username and password has changed yet, but they want to run a bunch of usernames and passwords to try to log into a system. We call this credential stuffing.

Really, anybody can do this, because there are free databases out there full of hacked usernames and passwords.

Checking whether your own credentials are out there

Here's a website, haveibeenpwned.com, that accesses those resources, those free databases that are out there. What you can do is type in your email address and do a check on it. What it will do is find any accounts that are associated with that email account that you type in here, and it will let you know if it's been compromised at any one of the sites you may have used that before.

More likely than not, if that email account has been around for a while and you've used it for several different companies to log into several different accounts, probably one of those companies out there has been compromised and that information has been leaked out. Maybe it's a username and password, maybe it's some other information. It will let you know on this website what information was leaked.

Running a credential file with Hydra

So let's see what that looks like, to use Hydra to run a credential file against a host.

I'm on that Kali Linux box, and what we're going to do, I'm just going to do a list here. This credential stuffing.txt is the one we're going to look at. So let's take a look at that — credential stuffing, and we'll hit enter here. You can see what it has is a list of usernames with an associated password with it. So it's going to check this username and password combination, and then go to the next username and password combination, and then the next. So it's not mixing and matching these, it's just going to run through this list.

So let's see what that looks like now. We're going to do Hydra, and we're going to do a capital C with that file credential stuffing.txt, going to 10.110.40, and we are trying FTP. So let's go ahead and hit enter here.

What it found was all three of those, with the username and password combination that we gave it. So that's an example of credential stuffing. Really, you just need one of those accounts to hit to be able to log into the system, so we really just need one of these to be successful.

Here's that attack card on credential stuffing. We're just using a stolen database of credentials to test it out on some sort of system.

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →