+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Beginner Hacking (https://hackforums.net/forumdisplay.php?fid=4)
+---- Thread: Tumblr - Password Protected Blogs (Possibly a very simple crack) (/showthread.php?tid=6269991)
Tumblr - Password Protected Blogs (Possibly a very simple crack) - pissing - May 1, 2024
It's a common forum etiquette to not bump old threads, as such I hope 8 years is enough to warrant a new one.
Old thread: hackforums.net/showthread.php?tid=1494899
A Password Protected Blog is not in itself an account - it's a blog, or, a profile that is protected with a password only and doesn't require you to know an email of the user. What's even better, tumblr gives you unlimited tries and does not require the password to be of any particular strength.
Many people set this password to be far simpler than the one they use for their account (for example, using only a couple of lowercase letters), as it only gives you the permission to read that one blog in particular, while an account can be used to set up multiple blogs.
This, along with some reading of the resources below, has lead me to believe that it should be fairly simple to either bruteforce it or crack it using a wordlist. Some guidance would be handy, as I have little experience coding beyond HTML, and perhaps there's some new tools now that would aid my little endeavour.
medium.com/@vaguilera/access-password-protected-tumblr-programmatically-1eb234de1143
sethioz.com/forum/viewtopic.php?t=1867
diablohorn.com/2017/08/15/brute-forcing-encrypted-web-login-forms/
help.tumblr.com/password-protected-blogs/
This blog suggest a phishing attempt, but I'm not after a specific blog so it's not exactly useful. I will still include it for others looking for it:
blog.buildingawesome.com/post/27430224720/hacking-tumblrs-password-protection-script
RE: Tumblr - Password Protected Blogs (Possibly a very simple crack) - SilentNuke - May 1, 2024
If it doesnt have an attempt limit, nor any kind of captcha in place, then the only solution is to brute force. You can do this with hydra and burpsuite quite easily, and you can find wordlists of common passwords using a simple google search.
Id recommend hydra over burpsuite tho, unless you have the pro version as the community edition limits your speed and payloads quite significantly.