I got my hands on an old-ish residential gateway with SIP support and two analog phone connections. I want to use it for it's SIP support to use analog phones with my SIP provider. I didn't know the admin password, so I performed a reset with the reset button. That did not get me any further.
The admin page only has a password, no username. Upon entering a wrong password it responds with a HTML page with a
<meta http-equiv="refresh"> tag. So, I grabbed my kali linux VM and hydra, and let it run overnight.
It was still running the following morning, but my browser showed the login page when I tried to connect. Apparently, the gateway does auth based on IP address rather than proper session management (quite common in my experience). The gateway manages the session based on the IP address.
I was able to set my own password in the management interface, and tried logging in with that. I captured the http exchange with mitmproxy, and discovered that the response for a correct password was exactly the same. The only difference is that you get the admin console after refreshing the page.
Naturally, hydra does not detect this, and continues to POST new passwords. I have access now, but I still don't know the default password. Does anyone have a suggestion to allow hydra to detect a correct password in this scenario?