1

I'm trying to Brute force the http Basic authentication on the domain

pentesteracademylab.appspot.com

The complete path is

pentesteracademylab.appspot.com/lab/webapp/basicauth

I'm using the module under the path in msf as

auxiliary/scanner/http/http_login

Have set AUTH_URI as

/lab/webapp/basicauth

VHOST and RHOSTS as

pentesteracademylab.appspot.com

Also have set the desired auth_type, method as post and other parameters. On giving run/ exploit, it gives an error. That is mentioned below.

msf auxiliary(http_login) > run

[*] Attempting to login to http://74.125.68.141:80/lab/webapp/basicauth
[-] 74.125.68.141:80 HTTP - Verification failed: No authentication required
[*] Scanned 2 of 2 hosts (100% complete)
[*] Auxiliary module execution completed

May be as google servers are being used for hosting the service, the above response is coming up however I've checked the same with nmap nse script 'http_brute' and could successfully brute the password/ username. Any ideas or suggestion so that I can move ahead ??

Note : For reference, "pentesteracademylab.appspot.com" is a practice lab.

--------------------------------------------------------------------------------

edit1

msf auxiliary(http_login) > show options

Module options (auxiliary/scanner/http/http_login):

   Name              Current Setting                            Required    Description

---- --------------- -------- -----------

   AUTH_URI          /lab/webapp/basicauth                      no            The URI to authenticate against (default:auto)
   BLANK_PASSWORDS   false                                      no        Try blank passwords for all users
   BRUTEFORCE_SPEED  5                                          yes       How fast to bruteforce, from 0 to 5
   DB_ALL_CREDS      false                                      no        Try each user/password couple stored in the current database
   DB_ALL_PASS       false                                      no        Add all passwords in the current database to the list
   DB_ALL_USERS      false                                      no        Add all users in the current database to the list
   PASSWORD                                                     no        A specific password to authenticate with
   PASS_FILE         /home/pentesterAcademy/demo/passwords.txt  no        File containing passwords, one per line
   Proxies                                                      no        A proxy chain of format type:host:port[,type:host:port][...]
   REQUESTTYPE       POST                                       no        Use HTTP-GET or HTTP-PUT for Digest-Auth, PROPFIND for WebDAV (default:GET)
   RHOSTS            pentesteracademylab.appspot.com            yes       The target address range or CIDR identifier
   RPORT             80                                         yes       The target port
   STOP_ON_SUCCESS   true                                       yes       Stop guessing when a credential works for a host
   THREADS           20                                         yes       The number of concurrent threads
   USERNAME          admin                                      no        A specific username to authenticate as
   USERPASS_FILE                                                no        File containing users and passwords separated by space, one pair per line
   USER_AS_PASS      false                                      no        Try the username as the password for all users
   USER_FILE                                                    no        File containing users, one per line
   VERBOSE           true                                       yes       Whether to print output for all attempts
   VHOST             pentesteracademylab.appspot.com            no        HTTP server virtual host
  • The error message has your clue: in your browser go to the URL that it lists : http://74.125.68.141:80/lab/webapp/basicauth - it doesn't show a login page (it's a 404) - you need to hunt down why it is converting the URL to an IP – schroeder Jul 17 '15 at 2:45
  • @schroeder I found the same details from the error however I could do it with nmap. That too using the same domain/ uri. Thanks anyway. – harveyD Jul 17 '15 at 2:48
  • But you aren't using the URL, you're using the IP. Did you use the IP with nmap? – schroeder Jul 17 '15 at 2:54
  • @schroeder I have given the auth_uri as "/lab/webapp/basicauth" and RHOSTS as "pentesteracademylab.appspot.com". It's changing into ip address on its own. Also I used the exact details in nmap as well, no ip. – harveyD Jul 17 '15 at 2:57
  • Have edited and posted a snap of given params on msf console. – harveyD Jul 17 '15 at 3:04