How can one brute force a website using HTTP Basic authentication using metasploit which uses XHR in background? I am getting error "No URI found that asks for HTTP authentication". Relevant headers are as below:

Authorization: Basic ###########
X-Requested-With: XMLHttpRequest

I did not found any relevant Metasploit options to set specific to XHR while using /auxiliary/scanner/http/http_login. Also site uses Ajax/Javascript for form submission.

Also when you visit the http://hostname:port it redirects to http://hostname:port>/#/signin, is this # here of any significance?
P.S. I am using URI_PATH = /#/signin as the option with no luck.

  • This is fascinating, I have no clue how my actual question asked on Security Stack Exchange, got here wordpressthemes.review/… Are people allowed to do that? Jan 25, 2016 at 5:12
  • 1
    Krishna - discussed at meta.stackexchange.com/q/200177/154443
    – Rory Alsop
    Jan 25, 2016 at 13:18
  • 1
    You could edit /usr/share/metasploit-framework/modules/auxiliary/scanner/http/http_login.rb to include the extra header with the request, or better still you could make a custom module from it with the option to add the header. Jan 26, 2016 at 9:24

1 Answer 1


Metasploit's http_login module doesn't support arbitrary HTTP headers. If the site only responds with the XHR header included, then you might want to use a more versatile tool like hydra.

# indicates the beginning of the URI fragment. This isn't a part of the URI used for logins, but is typically used to pass options to the front-end web framework.

  • I have used Hydra to brute-force http-basic authentication with www-authenticate header, will try for XHR one as well and let you know. Thanks. Jan 25, 2016 at 18:26

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .