[Exsanity]

So is it possible to bruteforce a php page that isn't a seperate login page but is on the main page?
I am currently using Hydra on kali linux is there any better way?
And any good wordlists? I am currently using a Dictionary word list and it is taking ages if i am even doing it properly which i don't think i am!
the website: ecpl.site.nfoservers.com

Any help is appreciated!

[liam270591]

http://null-byte.wonderhowto.com/how-to/...e-0160643/

[go for it]

So is it possible to bruteforce a php page that isn't a separate* login page but is on the main page?
doesn't matter as long as you can get the post action and the posted form to add it in hydra's command

I am currently using Hydra on kali linux is there any better way?
hydra is one of the best, and there is nothing complicated (anti forgery tokens or such), so in short any tool would do, i would still look for multi threading for speed and proxies for login attempts limit and if they lock accounts when brute force is detected

And any good wordlists? (google dude, use it)
https://wiki.skullsecurity.org/Passwords

[Exsanity]

Well getting a new password list i've also obtained a username but every 16 passwords it says it's valid and none of them are?
command im using

Code

hydra -l Maverick -P john.txt ecpl.site.nfoservers.com http-get-form "/:login_inputusername=^USER^&login_input_password=^PASS^:Denied"

with 2 different wordlists they both give me

Code

1 of 1 target successfully completed, 16 valid passwords found
Hydra finished at 2016-12-11 19:04:13

[go for it]

Well getting a new password list i've also obtained a username but every 16 passwords it says it's valid and none of them are?
command im using

Code

hydra -l Maverick -P john.txt ecpl.site.nfoservers.com http-get-form "/:login_inputusername=^USER^&login_input_password=^PASS^:Denied"

with 2 different wordlists they both give me

Code

1 of 1 target successfully completed, 16 valid passwords found
Hydra finished at 2016-12-11 19:04:13

hydra knows what's wrong, it doesn't know what's right, in a sense of, if there is no invalid password error then it think it've worked
while a brute force protection page (aka something like "please slow down" or "account is locked") is not a failure for hydra, it's simply a false positive

edit: just checking on myself, and yup seems to be the reason
check this one, similar case http://www.hackerthreads.org/Topic-47356

[Exsanity]

hydra knows what's wrong, it doesn't know what's right, in a sense of, if there is no invalid password error then it think it've worked
while a brute force protection page (aka something like "please slow down" or "account is locked") is not a failure for hydra, it's simply a false positive

edit: just checking on myself, and yup seems to be the reason
check this one, similar case (cnt POST LINSK)

Doing a little more research i figured the exact details i need put into hydra in the process of getting them i have gotten everything EXCEPT the most important part. what the error is, i forward in burpsuite but it doesn't show the error message like the site said it should so it doesn't know what the error message is so it doesn't know it's wrong, which is why it output all of them as correct
New command im running:

Code

hydra -l Maverick -P john.txt ecpl.site.nfoservers.com http-get-form "/index:user_name=^USER^&user_password=^PASS^&Login=login:Wrong password. Try again." -V

That's what the site says "Wrong password. Try again." when you enter the wrong password but even when trying it, still same results
Site is still ecpl.site.nfoservers.com
Edit: Also i can't use the site IP like i see in many how to etc with hydra because after tracing the dns i get the ip 208.180.42.68 and when i go to that ip i get nothing but the site can't be reached or on 208.156.35.11 it comes up with no website setup and redirects to NFO Rentals

[Exsanity]

I have looked through the files as well now and found something I think might be it but I am no good with php so I couldn't tell you but this is the code

Code

<div class="col-lg-4 col-lg-offset-4">
        <div class="lock-screen">
            <?php
            if ($login->messages) {
                foreach ($login->messages as $message) {
                    echo '<div style="margin-top: 200px;" class="alert alert-info animated infinite bounce" role="alert">' . $message . '</div>';
                }
            } elseif ($login->errors) {
                foreach ($login->errors as $error) {
                    echo '<div style="margin-top: 200px;" class="alert alert-danger animated infinite bounce" role="alert">' . $error . '</div>';
                }
            } else echo '<div style="margin-top: 270px;"></div>' ?>
        </div>
    </div>
</div>

Still need help if you need anymore info just ask

[gamexyuu]

Just a stupid question, as far as I (as a very beginner and amateur) have read about brute force hacking,
it all relies on the user/pass list right?

So, given that even I used a 100G sizing list, there is still a chance that the password is not listed and hence cannot be hacked, right?
I meant, think about that if the password is something personal, like: ilovejoyce4eva19911231
Could such password possibly be included in the passlist?

Just curious and wanna make sure my understanding, thanks! :D