So, long story short, I have been talking with a developer that is designing a website for us under a very high recommendation. They have had some break in's of late, and the developer has claimed it is all social engineering and falls under, 'not his problem'. With users current understanding, they have been very slack with their passwords assuming it can't be broken. I have been given the green light to try to break our site, just so we can clear this all up.

I really don't know much about security, but a very minor bit. I pretty much just picked up Hydra yesterday after this whole conversation. I have gathered that to attempt a brute force on a standard web form is simple:

hydra -L users -P passwords www.example.com http-post-form "/login/:login=^USER^&pin=^PASS^:Access Denied" (like on samsclass.info)

Got it working on my router and my couch potato login for testing. However, I have had a lot of difficulty with this one. The post form data I see in chrome developer tools is:


So I tried:

hydra -L users -P passwords www.example.com http-post-form "/login/:csrfmiddlewaretoken=b415c84adce1360bb495a311209dcb05&username=^USER^&password=^PASS^&this_is_the_login_form=1&next=%2Fadmin%2F:Access Denied"

Everytime I try, I get all passwords as valid, so I know I am probably misunderstanding, but I have had a hard time finding any examples that aren't just simple username and passwords. I double checked that csrfmiddlewaretoken and this_is_the_login_form are static values. I am a complete noob, and really starting to wonder if this is as hard to brute force as he is saying.

Browse other questions tagged or ask your own question.