3

I recently started experimenting with Hydra to try and crack my router's password and I'm having a problem.

Here's what I did: My router uses form-based HTTP POST authentication. After examining the network traffic, I noticed that the only POST parameter sent by the browser upon submitting the form was 'response' and its value seemed to be a random combination of 32 alphanumeric characters (no username is needed; just a password). I examined the router's webpage source code and it turned out that it uses JavaScript to encode the password. It joins the password with a string (I'm going to refer to it as a 'token') by a dash after running the password through an MD5 hashing algorithm. The token is different every time I try to log in. The result is then set as the value for the form field 'response'. I downloaded the JS code that does the hashing and was able to replicate the process with nodejs so that the output can be written to the console.

So far so good. The only problem is that I need to look for the token in the HTML source code. I need to find a way to make Hydra retrieve this token automatically.

In other words: is there a way I can automate Hydra to execute the following steps before doing the POST request:

  1. Get the login page with a GET request.
  2. Find the token. (with regular expressions maybe?)
Improve this question
0

1 Answer 1

Reset to default
2

Hydra is limited in the inputs that it can process, just like any other program. If you want Hydra to work on a modified input, you will have to create an interface for Hydra.

Burp might be your friend in this. There are many ways that you can write plug-ins that you could use as a foundation.

Improve this answer
2
  • @Archon If you would like, you could post the link to your Git repo so that others might benefit. In fact, such a Burp plug-in should be advertised (I have access to some channels to do that for you).
    – schroeder ♦
    Nov 22, 2015 at 17:14
  • Sorry for not replying to your answer (I'm not very active on StackExchange and I probably didn't see the email notification). I'm afraid I don't have the plugin code anymore. In any case, I'm not sure if it would have been much help anyway, since I wrote it specifically for my router. All it did was run the JavaScript code of the web page using NodeJS and use its output to modify a POST parameter.
    – Said Al Attrach
    Dec 19, 2016 at 23:35

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .