+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Website Hacking (https://hackforums.net/forumdisplay.php?fid=43)
+---- Thread: Guessed credentials and got redirected (/showthread.php?tid=5766219)
Guessed credentials and got redirected - lilium51 - Dec 10, 2017
So i have succesfully guessed credentials for an admin page of some site, however when i try to login it redirects me back in a sec.
What could be the reason? Was i detected? What should i try in this situation?
RE: Guessed credentials and got redirected - T3h Hack3r - Dec 10, 2017
Hi there. It sounds like the credentials are locked to a certain IP address, if you have an intercept tool handy like Zap Proxy or Burpsuite you may be able to change your originating IP address to something like 127.0.0.1 or localhost via the X-Forwarded-For header, this has worked for me within the past for actual penetration tests I have done for clients. You can read more about this attack here.
RE: Guessed credentials and got redirected - lilium51 - Dec 12, 2017
(Dec 10, 2017 09:13 PM)T3h Hack3r Wrote: Hi there. It sounds like the credentials are locked to a certain IP address, if you have an intercept tool handy like Zap Proxy or Burpsuite you may be able to change your originating IP address to something like 127.0.0.1 or localhost via the X-Forwarded-For header, this has worked for me within the past for actual penetration tests I have done for clients. You can read more about this attack here.
Thank you, it is interesting technique. I tried it in Burp, but got redirected again.
So, login.php redirects to index.php after entering credentials, and index.php back to login.php via window.location.
That's everything i learned from Burp.