4

I'm trying to penetrate test a web based form (which is MikroTik's login form) with different tools for security measurement.

I've tried THC-Hydra but problem is the password computed as MD5 first and then it is send to the form, like this:

username=USERNAME&password=458871649ad64f39c81ba19be9829c58&dst=&popup=true

As you can see, username is sent as plain text but password (which was entered as PASSWORD here as example) is computed as MD5 first and then sent to the server while Hydra puts password as plain text.

Any idea how to work it with Hydra (or any other tool)?

| improve this question | |
  • What about crafting your own MD5 hashes file, based on a plain-text words file? You could just provide the first file to Hydra, and then when the login is successful, you find the plain-text word link to the good hash. – MedAl Jun 11 '16 at 14:05
  • 1
    The most likely vulnerability to this is that the password file has the hashes in it. These hashes are basically clear-text passwords due to the client side hashing. So look for a SQLi to get the password table – Neil Smithline Jun 12 '16 at 1:27
  • @NeilSmithline would you please elaborate more? – idn Jun 13 '16 at 14:20
3

When using Hydra, you normally use -P password_list.txt to specify the input passwords. You simply need to md5sum this list. Consider this script hasher.sh:

#!/bin/bash
filename="$1"
while read -r line
do
    echo $line | md5sum
done < "$filename"

Now you can hash your original password list: ./hasher.sh password_list.txt | cut -d" " -f1 > hashed_passwords.txt

Finally, you can use hydra against your target using this new list of MD5s: hydra -L logins.txt -P hashed_passwords.txt <any other options> <target>

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.