I am trying to do successfull attack on my cisco home router using THC Hydra. I already know a username/password(admin/admin).
First with nmap I looked for open ports on router and only opened one is http 80.
> nmap 192.168.0.1 Starting Nmap 7.70 ( https://nmap.org ) at 2019-01-31 12:54 Central Europe Standard Time Nmap scan report for 192.168.0.1 Host is up (0.0082s latency). Not shown: 999 closed ports PORT STATE SERVICE 80/tcp open http MAC Address: ::::: (Cisco Spvtg) Nmap done: 1 IP address (1 host up) scanned in 3.66 seconds
> REQUEST and RESPONSE details General: Request URL: http://192.168.0.1/goform/Docsis_system Request Method: POST Status Code: 302 Redirect Remote Address: 192.168.0.1:80 Referrer Policy: no-referrer-when-downgrade Response Headers: Connection: close Content-type: text/html Location: http://192.168.0.1/Docsis_system.asp Server: PS HTTP Server Request Headers: Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9,sr;q=0.8 Cache-Control: max-age=0 Connection: keep-alive Content-Length: 84 Content-Type: application/x-www-form-urlencoded Cookie: Lang=en; SessionID=3909426640 Host: 192.168.0.1 Origin: http://192.168.0.1 Referer: http://192.168.0.1/Docsis_system.asp Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/71.0.3578.98 Safari/537.36 Form Data: username_login: bad_password password_login: bad_password LanguageSelect: en Language_Submit: 0 login: Log In
My hydra command looks like this:
hydra -l admin -p admin 192.168.0.1 http-post-form "/Docsis_system.asp:username_login=^USER^&password_login=^PASS^&LanguageSelect=en&Language_Submit=0&login=Log In:Invalid username or password.:H=Cookie: Lang=en; SessionID=3909626650"
Hydra v8.7-dev (c) 2018 by van Hauser/THC - Please do not use in military or secret service organizations, or for illegal purposes.
Hydra (http://www.thc.org/thc-hydra) starting at 2019-01-31 13:03:57 [DATA] max 1 task per 1 server, overall 1 task, 1 login try (l:1/p:0), ~1 try pe r task [DATA] attacking http-post-form://192.168.0.1:80/Docsis_system.asp:username_logi n=^USER^&password_login=^PASS^&LanguageSelect=en&Language_Submit=0&login=Log In: Invalid username or password.:H=Cookie: Lang=en; SessionID=3909626650 1 of 1 target completed, 0 valid passwords found Hydra (http://www.thc.org/thc-hydra) finished at 2019-01-31 13:04:01
Note that SessionID in command and at REQUEST HEADER section are not the same since in command I used new one after I refreshed page.
Anyway whatever I try output of hydra is: 1 of 1 target completed, 0 valid passwords found.
I tried various combinations where I left out fields like Lang, Language_Submit, LanguageSelect, also I tried to catch successfull password with S:admin but still no success.
Either I am making some stupid mistake or this router have some additional protection against this kind of attacks. Anyone have some suggestions?