I'm trying to recover my router username and password without resetting the router for educational purposes. I read that Hydra can be used for "brute-forcing" http-get-form authentication that most routers use. They classify bruteforcing as a dictionary/wordlist attack. Bruteforcing is generating every possible combination possible in order to guess the correct password/username. Yes, it can be time consuming and tedious. But given enough time they're always successful. I know that my password and username aren't all that complex as I don't see much of a reason to make it complex because with all the security measures I put up, no body will bother with my internet. I was reading a thread on Kali and someone asked if Hydra could legitimately "bruteforce" and I'm not sure honestly, but someone suggested using Crunch to feed words (combinations) to Hydra (not creating a massive 500 tb file full of words) and delete the ones not used (or successful). The OP of that thread was unsuccessful and so were many others who attempted to use this method. I know virtually nothing about Hydra. I probably left the password to my router as admin or something similar and the username something like mtndew. Is it possible to combine the two to create a bruteforcing tool for a router user/pass?

closed as off-topic by Steve, Steffen Ullrich, schroeder, Iszi, Stephane Jun 30 '15 at 7:27

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions asking us to break the security of a specific system for you are off-topic unless they demonstrate an understanding of the concepts involved and clearly identify a specific problem." – Steve, Steffen Ullrich, Stephane
If this question can be reworded to fit the rules in the help center, please edit the question.

  • I'm not understanding what your question really is. Hydra is used for this very purpose, which you state. Crunch can create wordlists that Hydra can use, which you state. What's your question? – schroeder Jun 29 '15 at 19:04

Short answer to your question is yes, Hydra and Crunch can be used in combination.

Your statement that "bruteforcing is generating every possible combination in order to guess..." is correct but the term "bruteforcing" is often used in relation to guessing based on a wordlist, so we just have to deal with the impercise term.

On to your goal of recovering your router username and password:

Try several different approaches, one being what you suggest, especially since you think you used a very easy to guess password: Run Hydra against the http form with a short list of simple passwords, then a longer one, then employ Crunch. The reason I suggest it is because you are likely to hit your password with one of the wordlists already supplied in Kali.

The other approach is attacking the router by other means besides Hydra as password guessing through a http form is very slow. It will be much faster if you can extract the hash of your password that is stored somewhere in your router and then run a hash cracker against it. Since you don't have your password, I assume you can't just ssh into your router and look at the passwd file. So, you will have to resort to researching router vulnerabilities and hoping that a vulnerability has been reported for your brand and version. I would say that it is worth doing this while Hydra is doing its work. Wifi Routers are famous for having unpatched vulnerabilities.

For example, read this: http://sijmen.ruwhof.net/weblog/268-password-hash-disclosure-in-linksys-smart-wifi-routers

What brand of router are you attacking? Does it have the OEM firmware installed?

  • It's a TP-Link archer C7 router. It has the original firmware installed although I had installed some other ones a while back. I reset it because I couldn't get it to work. – WMPR Jun 30 '15 at 1:29

Not the answer you're looking for? Browse other questions tagged or ask your own question.