0

I have 2 question after reading this guide on how to evaluate router admin password: https://buffercode.in/hack-crack-web-form-passwords-using-hydra-burpsuite-kali-linux/

This is the command format:

hydra -L <user list> -P <pass list> <ip address> <form parameters> <failed login message>

Now my questions are:

  1. If the router username and password are hashed in the POST form, how should we do?
  2. If there's no 'failed login message' but instead only a 200 response with 'Connection: close', how shall I tell hydra about success/failure of login.

Details:

This is the POST request send from my router's login form (both username and password = 'admin'):

Request URL: http://router.asus.com/login.cgi
Request Method: POST
Status Code: 200 OK
Remote Address: 192.168.1.1:80
Referrer Policy: no-referrer-when-downgrade
Connection: close
Content-Type: text/html
Date: Tue, 29 May 2018 18:51:21 GMT
Server: httpd/2.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9,zh-CN;q=0.8,zh;q=0.7
Cache-Control: max-age=0
Connection: keep-alive
Content-Length: 144
Content-Type: application/x-www-form-urlencoded
Host: router.asus.com
Origin: http://router.asus.com
Referer: http://router.asus.com/Main_Login.asp
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/68.0.3421.0 Safari/537.36

Form data:

group_id: 
action_mode: 
action_script: 
action_wait: 5
current_page: Main_Login.asp
next_page: index.asp
login_authorization: YWJjZDoxMjM0NDMyMQ==

The "login_authorization: YWJjZDoxMjM0NDMyMQ==" part is hashed, thus I could not simply pass username and password to the POST form.

Also, the response does not contain a failed message. It's just:

HTTP/1.0 200 OK
Server: httpd/2.0
Date: Wed, 30 May 2018 02:45:59 GMT
Content-Type: text/html
Connection: close

And then open another page:

GET /Main_Login.asp?error_status=3 HTTP/1.1
Host: router.asus.com
Connection: keep-alive
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/68.0.3421.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Referer: http://router.asus.com/login.cgi
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9,zh-CN;q=0.8,zh;q=0.7

If no 'failed login message', how does hydra know if login succeeds or failed?

Thanks for reading.

  • This is not an answer, just a suggestion: have you tried Nmap's http-form-brute NSE script? It handles pretty much all the web form stuff that a browser would, and you can quickly write custom code to handle unusual cases like HTTP header differences. – bonsaiviking May 30 '18 at 18:41

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.