0

While I'm trying to do a bruteforce attack on my router using routersploit. Im getting the error

rsf (HTTP Basic/Digest Bruteforce) > run
[*] Running module creds/generic/http_basic_digest_bruteforce...
[-] Resource / is not protected by Basic/Digest Auth

I'm able to understand that the path may be the problem here.

rsf (HTTP Basic/Digest Bruteforce) > show options

Target options:

   Name       Current settings     Description
   ----       ----------------     -----------
   ssl        false                SSL enabled: true/false
   target     192.168.1.1          Target IPv4, IPv6 address or file with ip:port (file://)
   port       80                   Target HTTP port


Module options:

   Name                Current settings                                                                          Description
   ----                ----------------                                                                          -----------
   verbosity           true                                                                                      Display authentication attempts
   threads             8                                                                                         Number of threads
   usernames           admin                                                                                     Username or file with usernames (file://)
   passwords           file:///mnt/c/Users/*****/routersploit/routersploit/resources/wordlists/passwords.txt     Password or file with passwords (file://)
   path                /
         URL Path
   stop_on_success     true
         Stop on first valid authentication attempt

The thing I don't understand is, what is this path and how is it used. If my assumption is incorrect, please help.

Improve this question

1 Answer 1

Reset to default
0

The path is the URI path that accepts credentials. While "/" may work in some cases, you may have to look at the requests your browser sends during login to determine the path (e.g. maybe something like "/cgi-bin/login").

Improve this answer
2
  • ok, i get it, but now after doing some research it seems that the router is not following the kind of authentication protocol as provided in the source code of routersploit, as " WWW-Authenticate" is not included in the header,,,or I'm getting the path wrong.(i tried the path,"/admin/login_en.asp")
    – Abrit Pal Singh
    Oct 4, 2020 at 4:34
  • Well, you selected "HTTP Basic/Digest Bruteforce", which is only correct if the router uses HTTP basic auth. Perhaps there's a different option within the tool? Again, you should be able to know the exact path and login method by watching your web browser's requests.
    – multithr3at3d
    Oct 4, 2020 at 12:26

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .