0

So, long story short, I have been talking with a developer that is designing a website for us under a very high recommendation. They have had some break in's of late, and the developer has claimed it is all social engineering and falls under, 'not his problem'. With users current understanding, they have been very slack with their passwords assuming it can't be broken. I have been given the green light to try to break our site, just so we can clear this all up.

I really don't know much about security, but a very minor bit. I pretty much just picked up Hydra yesterday after this whole conversation. I have gathered that to attempt a brute force on a standard web form is simple:

hydra -L users -P passwords www.example.com http-post-form "/login/:login=^USER^&pin=^PASS^:Access Denied" (like on samsclass.info)

Got it working on my router and my couch potato login for testing. However, I have had a lot of difficulty with this one. The post form data I see in chrome developer tools is:

csrfmiddlewaretoken=b415c84adce1360bb495a311209dcb05&username=admin&password=admin&this_is_the_login_form=1&next=%2Fadmin%2F

So I tried:

hydra -L users -P passwords www.example.com http-post-form "/login/:csrfmiddlewaretoken=b415c84adce1360bb495a311209dcb05&username=^USER^&password=^PASS^&this_is_the_login_form=1&next=%2Fadmin%2F:Access Denied"

Everytime I try, I get all passwords as valid, so I know I am probably misunderstanding, but I have had a hard time finding any examples that aren't just simple username and passwords. I double checked that csrfmiddlewaretoken and this_is_the_login_form are static values. I am a complete noob, and really starting to wonder if this is as hard to brute force as he is saying.

  • You forgot to ask a question... – Neil Smithline May 28 '15 at 5:19
  • 1
    You need hard proof as to the root of the problem. If dev says it is brute force guessing, ask for log records that show many login failures. Don't waste your time trying to crack the passwords. – Neil Smithline May 28 '15 at 5:25
  • Social engineering is different than brute force password guessing – Neil Smithline May 28 '15 at 12:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.