while i'm trying to do a brutforce attack on my router using routersploit. Im getting the error

rsf (HTTP Basic/Digest Bruteforce) > run
[*] Running module creds/generic/http_basic_digest_bruteforce...
[-] Resource / is not protected by Basic/Digest Auth

i'm able to understand that the path may be the problem here.

rsf (HTTP Basic/Digest Bruteforce) > show options

Target options:

   Name       Current settings     Description
   ----       ----------------     -----------
   ssl        false                SSL enabled: true/false
   target          Target IPv4, IPv6 address or file with ip:port (file://)
   port       80                   Target HTTP port

Module options:

   Name                Current settings                                                                          Description
   ----                ----------------                                                                          -----------
   verbosity           true                                                                                      Display authentication attempts
   threads             8                                                                                         Number of threads
   usernames           admin                                                                                     Username or file with usernames (file://)
   passwords           file:///mnt/c/Users/*****/routersploit/routersploit/resources/wordlists/passwords.txt     Password or file with passwords (file://)
   path                /
         URL Path
   stop_on_success     true
         Stop on first valid authentication attempt

the thing i don't understand is, what is this path and how it is used. if my assumption is incorrect, please help.


The path is the URI path that accepts credentials. While "/" may work in some cases, you may have to look at the requests your browser sends during login to determine the path (e.g. maybe something like "/cgi-bin/login").

  • ok, i get it, but now after doing some research it seems that the router is not following the kind of authentication protocol as provided in the source code of routersploit, as " WWW-Authenticate" is not included in the header,,,or I'm getting the path wrong.(i tried the path,"/admin/login_en.asp") – Abrit Pal Singh Oct 4 '20 at 4:34
  • Well, you selected "HTTP Basic/Digest Bruteforce", which is only correct if the router uses HTTP basic auth. Perhaps there's a different option within the tool? Again, you should be able to know the exact path and login method by watching your web browser's requests. – multithr3at3d Oct 4 '20 at 12:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.