I have 2 question after reading this guide on how to evaluate router admin password: https://buffercode.in/hack-crack-web-form-passwords-using-hydra-burpsuite-kali-linux/
This is the command format:
hydra -L <user list> -P <pass list> <ip address> <form parameters> <failed login message>
Now my questions are:
- If the router username and password are hashed in the POST form, how should we do?
- If there's no 'failed login message' but instead only a 200 response with 'Connection: close', how shall I tell hydra about success/failure of login.
This is the POST request send from my router's login form (both username and password = 'admin'):
Request URL: http://router.asus.com/login.cgi Request Method: POST Status Code: 200 OK Remote Address: 192.168.1.1:80 Referrer Policy: no-referrer-when-downgrade Connection: close Content-Type: text/html Date: Tue, 29 May 2018 18:51:21 GMT Server: httpd/2.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9,zh-CN;q=0.8,zh;q=0.7 Cache-Control: max-age=0 Connection: keep-alive Content-Length: 144 Content-Type: application/x-www-form-urlencoded Host: router.asus.com Origin: http://router.asus.com Referer: http://router.asus.com/Main_Login.asp Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/68.0.3421.0 Safari/537.36
group_id: action_mode: action_script: action_wait: 5 current_page: Main_Login.asp next_page: index.asp login_authorization: YWJjZDoxMjM0NDMyMQ==
The "login_authorization: YWJjZDoxMjM0NDMyMQ==" part is hashed, thus I could not simply pass username and password to the POST form.
Also, the response does not contain a failed message. It's just:
HTTP/1.0 200 OK Server: httpd/2.0 Date: Wed, 30 May 2018 02:45:59 GMT Content-Type: text/html Connection: close
And then open another page:
GET /Main_Login.asp?error_status=3 HTTP/1.1 Host: router.asus.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/68.0.3421.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8 Referer: http://router.asus.com/login.cgi Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9,zh-CN;q=0.8,zh;q=0.7
If no 'failed login message', how does hydra know if login succeeds or failed?
Thanks for reading.