Is it possible to brute force a flash login with hydra?

If not, what is a good tool to pen test a flash login?

2 Answers 2


You could use Burp Intruder. This is only in the paid version of Burp, but it's not that expensive.

You would first capture a manual login using the proxy, then use Intruder to fuzz for valid passwords.

  • So it's like setting up a MITM?
    – Jeff
    Apr 10, 2014 at 19:46
  • @Jeff - yeah, that's exactly how Burp works. You can do the MITM proxy with the free version, it's just Intruder you need a pro license for. You may be able to do this for free with Zap; I don't know if Zap supports the flash protocols (AMF, etc.) as well as Burp (which does it quite well).
    – paj28
    Apr 10, 2014 at 21:00

You should MITM the connection to see the actual HTTP request sent by the Flash applet (or use your browser's developer tools, they may display Flash-originated requests too).

Once you know what request is made you should be able to replicate it with Hydra.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .