1

Is it possible to brute force a flash login with hydra?

If not, what is a good tool to pen test a flash login?

1

You could use Burp Intruder. This is only in the paid version of Burp, but it's not that expensive.

You would first capture a manual login using the proxy, then use Intruder to fuzz for valid passwords.

  • So it's like setting up a MITM? – Jeff Apr 10 '14 at 19:46
  • @Jeff - yeah, that's exactly how Burp works. You can do the MITM proxy with the free version, it's just Intruder you need a pro license for. You may be able to do this for free with Zap; I don't know if Zap supports the flash protocols (AMF, etc.) as well as Burp (which does it quite well). – paj28 Apr 10 '14 at 21:00
0

You should MITM the connection to see the actual HTTP request sent by the Flash applet (or use your browser's developer tools, they may display Flash-originated requests too).

Once you know what request is made you should be able to replicate it with Hydra.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.