+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Beginner Hacking (https://hackforums.net/forumdisplay.php?fid=4)
+---- Thread: Bruteforcing a login Hydra Kali (/showthread.php?tid=5491164)
Bruteforcing a login Hydra Kali - Exsanity - Dec 11, 2016
So is it possible to bruteforce a php page that isn't a seperate login page but is on the main page?
I am currently using Hydra on kali linux is there any better way?
And any good wordlists? I am currently using a Dictionary word list and it is taking ages if i am even doing it properly which i don't think i am!
the website: ecpl.site.nfoservers.com
Any help is appreciated!
* - liam270591 - Dec 11, 2016
http://null-byte.wonderhowto.com/how-to/hack-like-pro-crack-online-web-form-passwords-with-thc-hydra-burp-suite-0160643/
* - go for it - Dec 11, 2016
So is it possible to bruteforce a php page that isn't a separate* login page but is on the main page?
doesn't matter as long as you can get the post action and the posted form to add it in hydra's command
I am currently using Hydra on kali linux is there any better way?
hydra is one of the best, and there is nothing complicated (anti forgery tokens or such), so in short any tool would do, i would still look for multi threading for speed and proxies for login attempts limit and if they lock accounts when brute force is detected
And any good wordlists? (google dude, use it)
https://wiki.skullsecurity.org/Passwords
* - Exsanity - Dec 11, 2016
Well getting a new password list i've also obtained a username but every 16 passwords it says it's valid and none of them are?
command im using
Code
hydra -l Maverick -P john.txt ecpl.site.nfoservers.com http-get-form "/:login_inputusername=^USER^&login_input_password=^PASS^:Denied"Code
1 of 1 target successfully completed, 16 valid passwords found
Hydra finished at 2016-12-11 19:04:13* - go for it - Dec 11, 2016
(Dec 11, 2016 05:20 PM)Exsanity Wrote: Well getting a new password list i've also obtained a username but every 16 passwords it says it's valid and none of them are?
command im usingwith 2 different wordlists they both give meCodehydra -l Maverick -P john.txt ecpl.site.nfoservers.com http-get-form "/:login_inputusername=^USER^&login_input_password=^PASS^:Denied"Code1 of 1 target successfully completed, 16 valid passwords found
Hydra finished at 2016-12-11 19:04:13
hydra knows what's wrong, it doesn't know what's right, in a sense of, if there is no invalid password error then it think it've worked
while a brute force protection page (aka something like "please slow down" or "account is locked") is not a failure for hydra, it's simply a false positive
edit: just checking on myself, and yup seems to be the reason
check this one, similar case http://www.hackerthreads.org/Topic-47356
* - Exsanity - Dec 11, 2016
(Dec 11, 2016 06:47 PM)go for it Wrote: hydra knows what's wrong, it doesn't know what's right, in a sense of, if there is no invalid password error then it think it've worked
while a brute force protection page (aka something like "please slow down" or "account is locked") is not a failure for hydra, it's simply a false positive
edit: just checking on myself, and yup seems to be the reason
check this one, similar case (cnt POST LINSK)
Doing a little more research i figured the exact details i need put into hydra in the process of getting them i have gotten everything EXCEPT the most important part. what the error is, i forward in burpsuite but it doesn't show the error message like the site said it should so it doesn't know what the error message is so it doesn't know it's wrong, which is why it output all of them as correct
New command im running:
Code
hydra -l Maverick -P john.txt ecpl.site.nfoservers.com http-get-form "/index:user_name=^USER^&user_password=^PASS^&Login=login:Wrong password. Try again." -VSite is still ecpl.site.nfoservers.com
Edit: Also i can't use the site IP like i see in many how to etc with hydra because after tracing the dns i get the ip 208.180.42.68 and when i go to that ip i get nothing but the site can't be reached or on 208.156.35.11 it comes up with no website setup and redirects to NFO Rentals
* - Exsanity - Dec 13, 2016
I have looked through the files as well now and found something I think might be it but I am no good with php so I couldn't tell you but this is the code
Code
<div class="col-lg-4 col-lg-offset-4">
<div class="lock-screen">
<?php
if ($login->messages) {
foreach ($login->messages as $message) {
echo '<div style="margin-top: 200px;" class="alert alert-info animated infinite bounce" role="alert">' . $message . '</div>';
}
} elseif ($login->errors) {
foreach ($login->errors as $error) {
echo '<div style="margin-top: 200px;" class="alert alert-danger animated infinite bounce" role="alert">' . $error . '</div>';
}
} else echo '<div style="margin-top: 270px;"></div>' ?>
</div>
</div>
</div>* - gamexyuu - Dec 14, 2016
Just a stupid question, as far as I (as a very beginner and amateur) have read about brute force hacking,
it all relies on the user/pass list right?
So, given that even I used a 100G sizing list, there is still a chance that the password is not listed and hence cannot be hacked, right?
I meant, think about that if the password is something personal, like: ilovejoyce4eva19911231
Could such password possibly be included in the passlist?
Just curious and wanna make sure my understanding, thanks! :D