How to bruteforce business and collaboration apps with Hydra and the Password Auditor

Usually, the Jira login form is found at the /login.jsp endpoint .

Use the Network tab in Web Developer Tools to identify the parameters.

After one invalid attempt, the following message is returned:

After two failed attempts, the CAPTCHA is activated.

In the first scenario, we used the following commands:

As you can see from the output, Hydra validly identified both the invalid and the valid credentials.

The following command is what we used for the second scenario, with multiple usernames and passwords:

Jira activated the CAPTCHA mechanism during the brute-force attack, preventing Hydra from identifying any valid credentials and causing it to mark all credentials as valid.

For the first scenario, these are the parameters we adjusted to perform a more focused scan:

• Target: http://jira.pentest-ground.com:8080/login.jsp

• Ports: Use port from target URL

• Services: HTTP

• Wordlists: pa-benchmark

Because the pa-benchmark wordlist includes the valid credentials, the tool will make 4 attempts against the target - 3 with invalid credentials and one with valid credentials.

As the screenshot below shows, the Password Auditor successfully identified the valid credentials.

Additionally, it also provided a screenshot of the logged-in session to confirm the tested credentials are valid.

In the second scenario, we only adjusted the wordlist to include 2 users (1 invalid and 1 valid) and 14 passwords (13 invalid and 1 valid).

The Password Auditor reported the Jira server activated its CAPTCHA protection. In the Details section, we recommend using the Password Spray attack type or splitting the scan into multiple scans with smaller wordlists.

Usually, Confluence login form sits at the /login.action endpoint.

Use the Network tab in Web Developer Tools to identify the parameters.

After one invalid attempt, the Confluence server returns the following message:

After 3 failed attempts, the CAPTCHA activates.

For the first scenario, we used the following commands to bruteforce Confluence with Hydra:

As you can see from the output, Hydra validly identified both the invalid and the valid credentials.

For the second bruteforcing scenario, we used the following command:

Hydra identified the valid credentials, when 2 users and 13 passwords were tested.

For the first scenario, these are the parameters we adjusted to perform a more focused scan:

• Target: http://confluence.pentest-ground.com:8090/dologin.action

• Ports: Use port from target URL

• Services: HTTP

• Wordlists: pa-benchmark

Because the pa-benchmark wordlist includes the valid credentials, the tool will make 4 attempts against the target - 3 with invalid credentials and one with valid credentials.

As highlighted in the screenshots below, the Password Auditor successfully identified the valid credentials.

The tool also included a screenshot of the logged-in session to confirm the validity of the provided credentials.

For the second scenario, we modified the wordlist to include 2 users (1 invalid and 1 valid) and 12 passwords (11 invalid and 1 valid).

Finally, the Password Auditor reports that the Confluence server activated its CAPTCHA protection. In the Details section, we recommend using the Password Spray attack type or splitting the scan into multiple scans with smaller wordlists.

You can usually find the Exchange login form at the /owa/auth/logon.aspx endpoint.

Use Burp Community Edition to determine the parameters.

After one invalid attempt, the Microsoft Exchange returns the following message:

In the first scenario, we used the following Hydra commands:

As you can see from the output, Hydra did not identify the invalid and valid credentials, marking both as valid credentials.

For the second scenario with multiple usernames and passwords, we used the following command:

When testing 2 users and 13 passwords, Hydra failed to differentiate between invalid and valid credentials, marking all as valid.

For the first scenario, these are the parameters we adjusted to perform a more focused scan:

• Target: https://mail.pentest-ground.com/owa/auth/logon.aspx

• Ports: Use port from target URL

• Services: HTTP

• Wordlists: pa-benchmark

As the pa-benchmark wordlist includes the valid credentials, the tool will make 4 attempts against the target - 3 with invalid credentials and one with valid credentials.

The Password Auditor successfully identified the valid credentials, as visible in these screenshots.

A screenshot of the logged-in session offers additional confirmation that the provided credentials are valid.

For the second scenario, we modified the wordlist to include 2 users (1 invalid and 1 valid) and 12 passwords (11 invalid and 1 valid).

The Password Auditor accurately identified the valid credentials when testing 2 users and 12 passwords.

You will usually find the Adobe Coldfusion login form at the /CFIDE/administrator/index.cfm endpoint on port 8500.

Use the Network tab in Web Developer Tools to identify the parameters.

When a user submits a password to an Adobe ColdFusion application, a JavaScript function in the user's web browser hashes the password on the client-side before transmitting it to the server. This prevents the password from being sent in plain text over the network.

The client-side hashing mechanism uses a combination of the following:

• MD5 hashing: The password is first hashed using the MD5 algorithm, which produces a 32-character hexadecimal string.

• Salt value: A random salt value that the Adobe ColdFusion server generates is appended to the MD5-hashed password. The salt value prevents rainbow table attacks.

• Base64 encoding: The resulting string (MD5 hash + salt value) is then Base64 encoded to produce a final hashed password string.

The ColdFusion server receives the hashed password string and either stores it in a database or compares it to an existing hash value for authentication.

After one invalid attempt, Adobe ColdFusion returns the following message:

In the first 1 set of valid and 1 set of invalid credentials scenario, we used the following Hydra commands:

Unfortunately, as mentioned in the “Find the web app login endpoint for Adobe ColdFusion” section for this application, the password is hashed client-side, and Hydra cannot use the JavaScript function available in a browser to hash the password. As a result, Hydra cannot identify valid credentials on Adobe ColdFusion.

Since the first scenario didn't work, we didn’t go forward with testing the second one.

For the first scenario, these are the parameters we adjusted to perform a more focused scan:

• Target: http://coldfusion.pentest-ground.com:8500/CFIDE/administrator/index.cfm

• Ports: Use port from target URL

• Services: HTTP

• Wordlists: pa-benchmark

The pa-benchmark wordlist includes valid credentials, so the process involves making four attempts to the target: 3 with invalid credentials and 1 with valid credentials.

The screenshots below show that the Pentest-Tools.com Password Auditor successfully identified the valid credentials.

The Password Auditor also provides a screenshot of the logged-in session to verify the validity of the provided credentials.

For the second scenario, we modified the wordlist to include 2 users (1 invalid and 1 valid) and 12 passwords (11 invalid and 1 valid). 

The Password Auditor identified the valid credentials when testing 2 users and 12 passwords.

Usually, the Weblogic login form sits on the /console/login/LoginForm.jsp endpoint on port 7001.

Use the Network tab in Web Developer Tools to identify the parameters.

After one invalid attempt, Oracle Weblogic returns the following message:

After 5 invalid login attempts to the Oracle Weblogic server, the user gets locked out for 30 minutes. 

In the first 1 set of valid and 1 set of invalid credentials scenario, we used the following Hydra commands to bruteforce Oracle Weblogic:

For the second scenario using multiple credentials, we used the following command:

Because Oracle WebLogic locks out the user for 30 minutes after 5 invalid attempts, Hydra did not identify the valid credentials when testing 2 users and 13 passwords.

For the first scenario, these are the parameters we adjusted to perform a more focused scan:

• Target: http://weblogic.pentest-ground.com:7001/console/login/LoginForm.jsp

• Ports: Use port from target URL

• Services: HTTP

• Wordlists: pa-benchmark

The pa-benchmark wordlist includes valid credentials, so the process involves making four attempts to the target: 3 with invalid credentials and 1 with valid credentials.

The Password Auditor also provides a screenshot of the logged-in session to verify the validity of the provided credentials.

For the second scenario, we modified the wordlist to include 2 users (1 invalid and 1 valid) and 12 passwords (11 invalid and 1 valid). 

Because Oracle Weblogic locked out the user for 30 minutes after 5 invalid attempts, the Pentest-Tools.com Password Auditor didn’t identify the valid credentials, when testing the target app with 2 users and 13 passwords.