OWASP ZAP bruteforce by password not username

Question

I want to bruteforce a login page using OWASP ZAP, using two separate passwords (90 lines) and username (200 lines) files, with the bruteforce POST requests to be ordered by password like:

user001:pass00
user002:pass00
....
user200:pass00
user001:pass01
user002:pass01
etc.

Fuzzing with wordlists is working with ZAP but I can't get this specific ordering happening, ZAP is trying all the passwords by each user name instead.

I've tried changing option Fuzzer: Options: Length / Breadth first but that has no effect.
My assumption is that ZAP is iterating through the payloads by the order that the POST parameters appear, but I am not able to edit the actual POST request in the Fuzzer to reorder them.
Additionally, once the Fuzzer is started, I can only pause or stop it but cannot reconfigure it.
Any insight into this would be appreciated.

Answer 1

tl;dr -- Use ZAP to find the username and password parameters, and then Hydra with the -u switch to brute force logins, iterating through users instead of passwords as you asked.

EDIT: you can also use Burp Intruder using Cluster Bomb to cycle through. Works pretty well but not quite as fast as Hydra if memory serves correctly. There may be a similar feature in ZAP but I'm not as familiar. See the last Attack Type on Burp's site here.

Detail --

I would use THC Hydra with the '-u' switch. The tool is very simple and accomplishes what you're looking at by default. It comes pre-installed on Kali, and you can install the package on most Unix-based systems.

From the Hydra man page, the -u switch will "loop around users, not passwords". This will try pass01 for all 200 users before trying pass02 for each user. Here is a sample of what your command should look like:

hydra www.target-url.com http-form-post -L usernames.txt -P passwords.txt "/path/to/login:username=^USER^&password=^PASS^:Incorrect Login" -u -V -o hydra_output.txt

Breakdown: "hydra" is the name of the program. "www.target-url.com" is the address of the target, but you can alternatively use an IP (and specify a port). "Http-form-post" is the service you are trying to brute force. "-L" and "-P" are pretty self-explanatory, they are your login username and password files.

The next portion in the double quotes has 3 parameters you can capture with the ZAP proxy or by viewing the source code, and they are separated by the ":". First is the path, followed by a colon and the username and password parameters identified by ZAP (I like Burp, but ZAP will do the trick). Hydra will replace the "^USER^" and "^PASS^" strings with the values from your user/pass files.

Finally, the -u, as said before, will iterate through usernames, rather than passwords. "-V" will show you every password guess in stdout so you can verify it's working as it should, and -o will output the successful password guesses to the hydra_output.txt file.

I hope this helped. I am not super familiar with ZAP, but the free edition of Burp Suite is a counterpart product as far as I know, and Burp Intruder should have the functionality you desire if you must use a proxy.