+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Website Hacking (https://hackforums.net/forumdisplay.php?fid=43)
+---- Thread: bruteforcing a shop login (/showthread.php?tid=5710793)
bruteforcing a shop login - joshythejew101 - Sep 4, 2017
they have /admin/ login, its just a popup with no error with incorrect login.
How do i start to bruteforce
Spoiler (Click to View)
![[Image: 39igILo.png]](https://i.imgur.com/39igILo.png)
PHP Code
<?php
GET https://*****/admin/ HTTP/1.1
Host: *******
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:54.0) Gecko/20100101 Firefox/54.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Authorization: Basic dXNlcjpwYXNz
* - Nine - Sep 4, 2017
The login is encoded in the headers.
"Authorization: Basic dXNlcjpwYXNz"
https://i.gyazo.com/712d374376799f8d12b5a6829e59d822.png
https://www.base64decode.org/
* - joshythejew101 - Sep 4, 2017
(Sep 4, 2017 10:14 PM)Nine Wrote: The login is encoded in the headers.yeah i didnt realise that, how would i go about using hydra to brute it then?
"Authorization: Basic dXNlcjpwYXNz"
https://i.gyazo.com/712d374376799f8d12b5a6829e59d822.png
https://www.base64decode.org/
hydra -L users.txt -P passwords.txt http://*****/admin/
* - Nine - Sep 4, 2017
(Sep 4, 2017 10:24 PM)joshythejew101 Wrote: yeah i didnt realise that, how would i go about using hydra to brute it then?
hydra -L users.txt -P passwords.txt http://*****/admin/
Never used Hydra. Only used Sentry.
* - joshythejew101 - Sep 4, 2017
(Sep 4, 2017 10:48 PM)Nine Wrote: Never used Hydra. Only used Sentry.
i use sentry as well, but no clue what to do in this case
* - hi_man - Sep 5, 2017
Do you know the type of encoding ?
If so then
I only know about
Burpsuite PRO
it changes the wordlist to some type of encoding.
Do you know about HTTP authentication ?
Study about them it will help you.
It will clear things more easily
* - joshythejew101 - Sep 5, 2017
(Sep 5, 2017 06:33 AM)hi_man Wrote: Do you know the type of encoding ?
If so then
I only know about
Burpsuite PRO
it changes the wordlist to some type of encoding.
Do you know about HTTP authentication ?
Study about them it will help you.
It will clear things more easily
ended up using a python script which runs the user:pass, cheers though mate
* - hi_man - Sep 5, 2017
Good for you
Welcome