2

I recently started experimenting with Hydra to try and crack my routers password and I'm a having a problem.

Here's what I did: My router uses form based HTTP POST authentication. After examining the network traffic, I noticed that the only POST parameter sent by the browser upon submitting the form was 'response' and its value seemed to be a random combination of 32 alphanumeric characters (no username is needed; just a password). I examined the routers webpage source code and it turned out that it uses JavaScript to encode the password. It joins the password with a string (I'm going to refer to it as a 'token') by a dash after running the password through an MD5 hashing algorithm. The token is different every time I try to log in. The result is then set as the value for the form field 'response'. I downloaded the JS code that does the hashing and was able to replicate the process with nodejs so that the output can be written to the console.

So far so good. The only problem is that I need to look for the token in the HTML source code. I need to find a way to make Hydra retrieve this token automatically.

In other words: is there a way I can automate Hydra to execute the following steps before doing the POST request: 1. Get the login page with a GET request. 2. Find the token. (with regular expressions maybe?)

If the problem is still unclear, I can explain it in more detail. I'm sorry if I'm missing something obvious. I'm still a noob :P

  • I think you are trying to get hydra to do too much. I think you would need to code an interface between the page and hydra so that hydra could automate the modified brute force. Burp might be your friend in this. – schroeder Nov 19 '15 at 22:48
  • 1
    Thank you!! I managed to get Burp to do what I want. I wrote a plugin that modifies the HTTP requests and responses. Took a couple of days to figure it out but it was worth it. Thanks again! Can I mark your comment as an answer somehow? – Said Al Attrach Nov 22 '15 at 9:45
1

As requested, this is my comment as an answer.

Hydra is limited in the inputs that it can process, just like any other program. If you want Hydra to work on a modified input, you will have to create an interface for Hydra.

Burp might be your friend in this. There are many ways that you can write plug-ins that you could use as a foundation.

  • @Archon If you would like, you could post the link to your Git repo so that others might benefit. In fact, such a Burp plug-in should be advertised (I have access to some channels to do that for you). – schroeder Nov 22 '15 at 17:14
  • Sorry for not replying to your answer (I'm not very active on StackExchange and I probably didn't see the email notification). I'm afraid I don't have the plugin code anymore. In any case, I'm not sure if it would have been much help anyway, since I wrote it specifically for my router. All it did was run the JavaScript code of the web page using NodeJS and use its output to modify a POST parameter. – Said Al Attrach Dec 19 '16 at 23:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.