[joshythejew101]

they have /admin/ login, its just a popup with no error with incorrect login.
How do i start to bruteforce

Spoiler (Click to View)

PHP Code


<?php 
GET https://*****/admin/ HTTP/1.1
Host: *******
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:54.0) Gecko/20100101 Firefox/54.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Authorization: Basic dXNlcjpwYXNz 


[Nine]

The login is encoded in the headers.

"Authorization: Basic dXNlcjpwYXNz"
https://i.gyazo.com/712d374376799f8d12b5...59d822.png
https://www.base64decode.org/

[joshythejew101]

The login is encoded in the headers.

"Authorization: Basic dXNlcjpwYXNz"
https://i.gyazo.com/712d374376799f8d12b5...59d822.png
https://www.base64decode.org/

yeah i didnt realise that, how would i go about using hydra to brute it then?
hydra -L users.txt -P passwords.txt http://*****/admin/

[Nine]

yeah i didnt realise that, how would i go about using hydra to brute it then?
hydra -L users.txt -P passwords.txt http://*****/admin/

Never used Hydra. Only used Sentry.

[joshythejew101]

Never used Hydra. Only used Sentry.

i use sentry as well, but no clue what to do in this case

[hi_man]

Do you know the type of encoding ?
If so then
I only know about
Burpsuite PRO
it changes the wordlist to some type of encoding.

---

Do you know about HTTP authentication ?
Study about them it will help you.
It will clear things more easily

[joshythejew101]

Do you know the type of encoding ?
If so then
I only know about
Burpsuite PRO
it changes the wordlist to some type of encoding.

---

Do you know about HTTP authentication ?
Study about them it will help you.
It will clear things more easily

ended up using a python script which runs the user:pass, cheers though mate

[hi_man]

Good for you

Welcome