Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is it possible to brute force a flash login with hydra?

If not, what is a good tool to pen test a flash login?

share|improve this question
up vote 1 down vote accepted

You could use Burp Intruder. This is only in the paid version of Burp, but it's not that expensive.

You would first capture a manual login using the proxy, then use Intruder to fuzz for valid passwords.

share|improve this answer
So it's like setting up a MITM? – Jeff Apr 10 '14 at 19:46
@Jeff - yeah, that's exactly how Burp works. You can do the MITM proxy with the free version, it's just Intruder you need a pro license for. You may be able to do this for free with Zap; I don't know if Zap supports the flash protocols (AMF, etc.) as well as Burp (which does it quite well). – paj28 Apr 10 '14 at 21:00

You should MITM the connection to see the actual HTTP request sent by the Flash applet (or use your browser's developer tools, they may display Flash-originated requests too).

Once you know what request is made you should be able to replicate it with Hydra.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.