Comments on: How to brute force http forms in windows http://www.sillychicken.co.nz/2011/05/how-to-brute-force-http-forms-in-windows/?utm_source=rss&utm_medium=rss&utm_campaign=how-to-brute-force-http-forms-in-windows The boat engine makes noise..... Tue, 21 Feb 2012 20:13:54 +0000 hourly 1 http://wordpress.org/?v=3.3.1 By: Sillychicken http://www.sillychicken.co.nz/2011/05/how-to-brute-force-http-forms-in-windows/#comment-272 Sillychicken Sun, 15 Jan 2012 06:29:40 +0000 http://wordpress.sillychicken.co.nz/?p=35#comment-272 Link removed, yes it should be renamed I will do an update to make the title reflect the attack. Link removed, yes it should be renamed I will do an update to make the title reflect the attack.

]]> By: Dave http://www.sillychicken.co.nz/2011/05/how-to-brute-force-http-forms-in-windows/#comment-271 Dave Sun, 15 Jan 2012 05:37:43 +0000 http://wordpress.sillychicken.co.nz/?p=35#comment-271 Why is this listed as a "brute force" attack if you need a dictionary file? Also, "max25" above, you neglect to mention that the "uniqpass" password file mentioned on that site is not FREE! That scam site (which is getting plugged in the comments of every single hydra post) is asking for $4 to get a copy of that file. Fuck them. Why is this listed as a “brute force” attack if you need a dictionary file?

Also, “max25″ above, you neglect to mention that the “uniqpass” password file mentioned on that site is not FREE! That scam site (which is getting plugged in the comments of every single hydra post) is asking for $4 to get a copy of that file. Fuck them.

]]> By: Rogan http://www.sillychicken.co.nz/2011/05/how-to-brute-force-http-forms-in-windows/#comment-237 Rogan Tue, 06 Dec 2011 12:47:45 +0000 http://wordpress.sillychicken.co.nz/?p=35#comment-237 Unfortunately, this does not work on all versions of Joomla, because the Admin logon page includes a random token that gets updated with every request, and there is no mechanism to specify this in Hydra. i.e. "/administrator/index.php:username=^USER^&passwd=^PASS^&lang=&option=com_login&task=login&cec21c04bff97e66ecc0068f5cb4507d=1:do not match" The token "cec21c04bff97e66ecc0068f5cb4507d" needs to change with every request. While hydra can get a new cookie if required, there is no mechanism to tell it to get new form values/parameters on each submission. Pity. Unfortunately, this does not work on all versions of Joomla, because the Admin logon page includes a random token that gets updated with every request, and there is no mechanism to specify this in Hydra.

i.e.

“/administrator/index.php:username=^USER^&passwd=^PASS^&lang=&option=com_login&task=login&cec21c04bff97e66ecc0068f5cb4507d=1:do not match”

The token “cec21c04bff97e66ecc0068f5cb4507d” needs to change with every request. While hydra can get a new cookie if required, there is no mechanism to tell it to get new form values/parameters on each submission.

Pity.

]]> By: Sillychicken http://www.sillychicken.co.nz/2011/05/how-to-brute-force-http-forms-in-windows/#comment-165 Sillychicken Mon, 28 Nov 2011 09:22:25 +0000 http://wordpress.sillychicken.co.nz/?p=35#comment-165 Valid point :-o Valid point :-o

]]> By: iDOn http://www.sillychicken.co.nz/2011/05/how-to-brute-force-http-forms-in-windows/#comment-159 iDOn Sun, 27 Nov 2011 19:48:51 +0000 http://wordpress.sillychicken.co.nz/?p=35#comment-159 this is not a brute force mode because you are using a list of passwords, it's called dictionary attack this is not a brute force mode because you are using a list of passwords, it’s called dictionary attack

]]>