HTTP POST Login Form

We will try to crack the password for login form using hydra.

Step for Bruteforcing login form

Required thing:

We must first gather two different pieces of information. The first is the POST data itself, which contains the request body specifying the username and password. Second, we must capture a failed login attempt to help Hydra differentiate between a successful and a failed login.

Step 1: Capture Post data

Visit page and add any username and password and capture the request using burp suite.

Captured post data

fm_usr=user&fm_pwd=user

Step 2: Capture the error message.

Enter the username and password in login form and then capture the error message you get.

Getting this error message.

Login failed. Invalid username or password

Step 3: Crafting Command

We will combine the obtained data.

For this we will use one special option called as http-post-form. This has three parts:

1. it is location of login form.

2. Post data that we captured using burp suite.

3. Error message that we got after failed login. (To avoid false positive data we will remove commonly used words)

# Final Command:
hydra -l user -P /usr/share/wordlists/rockyou.txt 192.168.129.201 http-post-form "/index.php:fm_usr=user&fm_pwd=^PASS^:Login failed. Invalid"

# If we want to enumerate the userlist then use command in this way:
hydra -L userlist.txt -P /usr/share/wordlists/rockyou.txt 192.168.129.201 http-post-form "/index.php:fm_usr=user&fm_pwd=^PASS^:Login failed. Invalid"

Steps for Brute forcing Basic HTTP Authentication

https://freedium.cfd/https://infosam.medium.com/notes-on-brute-force-attacks-using-hydra-25a3819545edfreedium.cfd

Help for basic HTTP Authentication

229KB

freedium-cfd-infosam-medium-com-notes-on-brute-force-attacks-using-hydra-25a3819.pdf

PDF

Open

Below is image of how Basic HTTP Authentication looks like:

From here i got command for brute forcing basic http authentication service.

http-get command and http-post command can be used.

we will try both

command:

hydra -l <user> -P <path_to/SecLists/Passwords/Leaked-Databases/rockyou.txt> -f <TARGET_IP> -s <PORT> http-get /

# Example:
hydra -l admin -P /usr/share/wordlists/rockyou.txt -f 192.168.129.201 -s 80 http-get /