☄️Basic HTTP Auth Brute Forcing
To install hydra -> "apt install hydra -y" or download it and use it from its Github Repository
It's good to start with lists of default passwords such as test:test,if we could not find any working pairs, we would move to use separate wordlists
Good lists are from seclist in the /usr/share/seclists/Passwords/Default-Credentials
And the output will look something like that:
Using the technique you learned in this section, try attacking the IP shown above. What are the credentials used?
Credentials can also be separated by usernames and passwords. We can use the -L flag for the usernames wordlist and the -P flag for the passwords wordlist. Since we don't want to brute force all the usernames in combination with the passwords in the lists, we can tell hydra to stop after the first successful login by specifying the flag -f.
Username/Password Attack
"-u" flag so that it tries all users on each password and goes faster
Username Brute Force
we can brute force passwords for the test user by adding -l test
If we already found the password in the previous section, we may statically assign it with the "-p" flag, and only brute force for usernames that might use this password.
Last updated
