Web Based penetration test that uses MD5 for password

Question

I'm trying to penetrate test a web based form (which is MikroTik's login form) with different tools for security measurement.

I've tried THC-Hydra but problem is the password computed as MD5 first and then it is send to the form, like this:

username=USERNAME&password=458871649ad64f39c81ba19be9829c58&dst=&popup=true

As you can see, username is sent as plain text but password (which was entered as PASSWORD here as example) is computed as MD5 first and then sent to the server while Hydra puts password as plain text.

Any idea how to work it with Hydra (or any other tool)?

Answer 1

When using Hydra, you normally use -P password_list.txt to specify the input passwords. You simply need to md5sum this list. Consider this script hasher.sh:

#!/bin/bash
filename="$1"
while read -r line
do
    echo $line | md5sum
done < "$filename"

Now you can hash your original password list: ./hasher.sh password_list.txt | cut -d" " -f1 > hashed_passwords.txt

Finally, you can use hydra against your target using this new list of MD5s: hydra -L logins.txt -P hashed_passwords.txt <any other options> <target>