+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Website Hacking (https://hackforums.net/forumdisplay.php?fid=43)
+---- Thread: Bruteforce HTML login forms (/showthread.php?tid=6222381)
Pages: Pages
1
2
Bruteforce HTML login forms - shahank - Sep 27, 2022
Here's a blog post I wrote that describes an approach one can follow to crack a user login form with a dictionary attack.
hecktheplanet .wordpress. com/2022/09/25/0x02-et-tu-bruteforce/
RE: Bruteforce HTML login forms - 73SLA - Sep 27, 2022
Actually didn't work SO
SO
...u need to change your method .
Bruteforce is just 95% lobby and 5% real .
RE: Bruteforce HTML login forms - shahank - Sep 27, 2022
(Sep 27, 2022 08:58 AM)73SLA Wrote: Actually didn't work SO
SO
...u need to change your method .
Bruteforce is just 95% lobby and 5% real .
Did you try giving a suitable path to the wordlist? Since that would be according to the attacker's preference.
Other than that, I've checked and there should be no reason for it not to work.
RE: Bruteforce HTML login forms - skags - Sep 27, 2022
I would totally agree with the above. Most of the time- doesnt work.
RE: Bruteforce HTML login forms - shahank - Sep 27, 2022
(Sep 27, 2022 10:19 AM)skags Wrote: I would totally agree with the above. Most of the time- doesnt work.
Yes of course.
I even take up that point in the post at the end.
At the end of the day, the program is just a glorified proof-of-concept and literally any other method to bypass logins is a better way than bruteforcing the password.
RE: Bruteforce HTML login forms - Goku - Sep 27, 2022
I haven't visited your blog.
But, since I make websites for customers. Does Google Recaptcha help against your bruteforce? I would guess yes.
RE: Bruteforce HTML login forms - SuperiorUser - Sep 27, 2022
(Sep 27, 2022 10:37 AM)Goku Wrote: I haven't visited your blog.
But, since I make websites for customers. Does Google Recaptcha help against your bruteforce? I would guess yes.
if implemented correctly it can slow an attack down enough to not be cost viable to use dictionary attacks.
RE: Bruteforce HTML login forms - shahank - Sep 27, 2022
(Sep 27, 2022 10:37 AM)Goku Wrote: I haven't visited your blog.
But, since I make websites for customers. Does Google Recaptcha help against your bruteforce? I would guess yes.
Totally does.
As much as I would like to think that there are some fancy ways of bypassing ReCaptchas on login pages, there isn't really that much an attacker can do apart from bruteforcing the ReCaptchas themselves (which is completely insane), or finding some fault in the ReCaptcha itself (faulty RNG?) and exploiting that.
RE: Bruteforce HTML login forms - Goku - Sep 27, 2022
(Sep 27, 2022 10:43 AM)SuperiorUser Wrote: if implemented correctly it can slow an attack down enough to not be cost viable to use dictionary attacks.
(Sep 27, 2022 10:44 AM)shahank Wrote: Totally does.
As much as I would like to think that there are some fancy ways of bypassing ReCaptchas on login pages, there isn't really that much an attacker can do apart from bruteforcing the ReCaptchas themselves (which is completely insane), or finding some fault in the ReCaptcha itself (faulty RNG?) and exploiting that.
Thanks for the feedback guys!
RE: Bruteforce HTML login forms - johngacy - Sep 27, 2022
Hopefully AI will outpace those pesky captchas (in my Masters I wrote an article with source code on cracking 2000s-style captchas).
Anyway awesome article!
RE: Bruteforce HTML login forms - shahank - Sep 27, 2022
(Sep 27, 2022 12:12 PM)johngacy Wrote: Hopefully AI will outpace those pesky captchas (in my Masters I wrote an article with source code on cracking 2000s-style captchas).
Anyway awesome article!
Much appreciated!
And wow that article you mentioned sounds totally interesting.
RE: Bruteforce HTML login forms - bl4ckc0d3 - Oct 1, 2022
Not sure why the article says "bypassing http logins" a dictionary attack is basically trying a bunch of passwords or usernames until it matches the right one, which is cracking. Bypassing the login page usually means you found a method to bypass the login page without entering any usernames or passwords.
RE: Bruteforce HTML login forms - SIM-5255902 - Oct 1, 2022
is there any way to bypass re/captcha in logins pages ?
RE: Bruteforce HTML login forms - bl4ckc0d3 - Oct 2, 2022
(Oct 1, 2022 04:30 PM)SIM-5255902 Wrote: is there any way to bypass re/captcha in logins pages ?
i've seen a few cases where the captcha is easy to guess or using the same recaptcha works.
RE: Bruteforce HTML login forms - SIM-5255902 - Oct 2, 2022
Tensorflow also can bypass easy one like numbers ...