I'm trying to penetrate test a web based form (which is MikroTik's login form) with different tools for security measurement.

I've tried THC-Hydra but problem is the password computed as MD5 first and then it is send to the form, like this:


As you can see, username is sent as plain text but password (which was entered as PASSWORD here as example) is computed as MD5 first and then sent to the server while Hydra puts password as plain text.

Any idea how to work it with Hydra (or any other tool)?

  • What about crafting your own MD5 hashes file, based on a plain-text words file? You could just provide the first file to Hydra, and then when the login is successful, you find the plain-text word link to the good hash.
    – MedAl
    Jun 11, 2016 at 14:05
  • 1
    The most likely vulnerability to this is that the password file has the hashes in it. These hashes are basically clear-text passwords due to the client side hashing. So look for a SQLi to get the password table Jun 12, 2016 at 1:27
  • @NeilSmithline would you please elaborate more?
    – idn
    Jun 13, 2016 at 14:20

1 Answer 1


When using Hydra, you normally use -P password_list.txt to specify the input passwords. You simply need to md5sum this list. Consider this script hasher.sh:

while read -r line
    echo $line | md5sum
done < "$filename"

Now you can hash your original password list: ./hasher.sh password_list.txt | cut -d" " -f1 > hashed_passwords.txt

Finally, you can use hydra against your target using this new list of MD5s: hydra -L logins.txt -P hashed_passwords.txt <any other options> <target>

  • Just pay attention to the fact that your script includes the newline char since you're using echo which the original login system might not include. So you might need to use echo -n or printf to successfully simulate the original system behavior. Oct 6, 2021 at 13:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.