How do you know which attack method to use when using software like thc hydra, brutus, etc? e.g. http-get, https-get, http-form-get, http-form-post, etc?

For example, for sites like Yahoo, Gmail, and Hotmail it's POP3.

In this question, for example, the poster says he:

  • pinged the website and obtained the IP address of
  • identified the form type as a https-form-post

My question is how you do the second step, so you know which attack method to use?

  • In future, please do not cross post. – Rory Alsop Apr 22 '14 at 17:09

View the page HTML source and locate the form tag.

Look for the action and method.

e.g. on www.facebook.com the source shows

<form id="login_form" action="https://www.facebook.com/login.php?login_attempt=1" method="post"

Here you can see that it is a https form and that the method is POST.

If there is no action then the default is GET.

How these correspond with the terminology in the individual tools will differ, but learning the different HTTP methods will be useful in order to attack them.

  • WOW! Thank you SilverlightFox! such great and clear directions. much appreciated!! – thisisjnd Apr 17 '14 at 9:46
  • just one more doubt, @SilverlightFox. I got a bit confused with the last thing you said "How these correspond with the terminology in the individual tools will differ" - - - - - in the example you provided, wouldnt the attack method simply be https-post ? – thisisjnd Apr 17 '14 at 9:58
  • 1
    @thisisjnd Probably, but I wouldn't be able to tell you off the top of my head what the difference would be between http-form-get and http-get because these are technically the same to the server, but might differ in how the tools treat them. – SilverlightFox Apr 17 '14 at 10:02
  • ah ok. and to edit my last comment, it would be https-form-post since https-post doesnt exist :P – thisisjnd Apr 17 '14 at 10:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.