4

I needed to test how Hydra works, so I tried to attack my own wifi router. I set the user name as "user" and created a txt file containing 100 passwords including the "real" password.

I am unable to read the log in of the http request that contains the ^USER^ and ^PASS^ because it uses a hashing method and passes the request as an encoded string.

Here, is what I found:

3470a61d9cbb0b8d3a81749ef188169ce88ea5e727579b9bee86b7131b90a2693267e16b59cdbfeb8fc5cf3a886153c8e2322ba4e8626986a84f7d263aaa0aff79aa2a9635ac17392a9b5efbd49d454c527a58ca035fe608405335fc1ea8fc7c54a030140084cad9f7192d5a2b8c3bbc89531f5b3ec593d34e2a5c190f3a1494655fc23d0207c6418076eb76c9aeab24904030d9ff8259ae927fef25059adfe82a5164968bd1d903a8832dfee3052cb5773c42515a0493696422178ceabd0a48d34304c923d4a973c325ca06ea9dfb74054996b641a21456753ae9558e22ec1423b22837254d93894d7fb9523555632a60b027109806ff3a46ddbbc2aace930959ff334d29f3f4c4e6f1c20374eebb6015cb82894e709e438a8549f34b2886e13218dfb641a8f782f8a3e06a0d34f029972bdb3b1eba3bd42e4cbf82727c0088361e6e9a590dba9dbf3da6016d4af074aa42f9dc18ac3c438ac091d723f8412dbe2a9879c93d51a402a881e5ee9285d699a6d53afb16c0d56e76348061035766f875c318da1ab439610134a1b19be1fe79c3287fa803d1bca5e2a1c73f66b4aa704ec613d840d702fab77fdcc91a71d3150beee8c1b1b3efeaaa020295bb732f4e5bc701c726d9c611502fa0bbf9b4f211986207fe96fba09e07a4fe2ee908120aa36b7db9e1d2082f2c4fae091525bb766d5d41e6091565b30d119774942229.

Here is a screenshot; enter image description here

And I inspected main.js file of that website, and realized that there are some hashing methods used;

if(g_password_type == '4') {
psd = base64encode(SHA256(name + base64encode(SHA256($('#password').val())) + g_requestVerificationToken[0]));
} else {
psd = base64encode($('#password').val());
}

In such a case, how can we bruteforce the username and password?

Is there a way in hydra to point out "this" is the password field and "this" is the username text and test when "this" log in button is pressed?

5
+50

As the code clearly indicates, the name, password, and verification token are hashed together before being sent over the network. So, no, you cannot figure out which is which just from the network data alone.

Hydra is not the tool that is going to work for you here. You need to come up with a way of sending psd with all that data formatted in the expected way (combined, hashed, and encoded).

  • If hydra not works here, how should I start? – Tharindu Sathischandra Jun 11 '18 at 12:44
  • You will need to create a script that does hydra's work for you and send the data in the way that the server expects. – schroeder Jun 11 '18 at 12:46
  • Actually I don't have any understanding about how should I create such a script. What field I should learn to accomplish my task. Can you suggest me how should I start? – Tharindu Sathischandra Jun 11 '18 at 12:48
  • The javascript code tells you exactly what to do - you just need to replicate that in your script and feed it a list of usernames and passwords. – schroeder Jun 11 '18 at 12:49
  • Can I use my own code and send the website data as we sends in normal GUI. – Tharindu Sathischandra Jun 11 '18 at 12:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.