I want to bruteforce a login page using OWASP ZAP, using two separate passwords (90 lines) and username (200 lines) files, with the bruteforce POST requests to be ordered by password like:


Fuzzing with wordlists is working with ZAP but I can't get this specific ordering happening, ZAP is trying all the passwords by each user name instead.

I've tried changing option Fuzzer: Options: Length / Breadth first but that has no effect.
My assumption is that ZAP is iterating through the payloads by the order that the POST parameters appear, but I am not able to edit the actual POST request in the Fuzzer to reorder them.
Additionally, once the Fuzzer is started, I can only pause or stop it but cannot reconfigure it.
Any insight into this would be appreciated.

1 Answer 1


tl;dr -- Use ZAP to find the username and password parameters, and then Hydra with the -u switch to brute force logins, iterating through users instead of passwords as you asked.

EDIT: you can also use Burp Intruder using Cluster Bomb to cycle through. Works pretty well but not quite as fast as Hydra if memory serves correctly. There may be a similar feature in ZAP but I'm not as familiar. See the last Attack Type on Burp's site here.

Detail --

I would use THC Hydra with the '-u' switch. The tool is very simple and accomplishes what you're looking at by default. It comes pre-installed on Kali, and you can install the package on most Unix-based systems.

From the Hydra man page, the -u switch will "loop around users, not passwords". This will try pass01 for all 200 users before trying pass02 for each user. Here is a sample of what your command should look like:

hydra www.target-url.com http-form-post -L usernames.txt -P passwords.txt "/path/to/login:username=^USER^&password=^PASS^:Incorrect Login" -u -V -o hydra_output.txt

Breakdown: "hydra" is the name of the program. "www.target-url.com" is the address of the target, but you can alternatively use an IP (and specify a port). "Http-form-post" is the service you are trying to brute force. "-L" and "-P" are pretty self-explanatory, they are your login username and password files.

The next portion in the double quotes has 3 parameters you can capture with the ZAP proxy or by viewing the source code, and they are separated by the ":". First is the path, followed by a colon and the username and password parameters identified by ZAP (I like Burp, but ZAP will do the trick). Hydra will replace the "^USER^" and "^PASS^" strings with the values from your user/pass files.

Finally, the -u, as said before, will iterate through usernames, rather than passwords. "-V" will show you every password guess in stdout so you can verify it's working as it should, and -o will output the successful password guesses to the hydra_output.txt file.

I hope this helped. I am not super familiar with ZAP, but the free edition of Burp Suite is a counterpart product as far as I know, and Burp Intruder should have the functionality you desire if you must use a proxy.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.