How to bruteforce CMSs and e-commerce apps with Hydra and the Password Auditor

The WordPress administrator login usually sits on the /wp-login.php endpoint.

Use the Network tab in the browser’s Web Developer Tools to find the login parameters.

After one invalid attempt, the WordPress app returns the following message:

After 10 invalid attempts, the Wordfence plugin (pre-installed in the deployed environment) gets triggered. Note that the block only works for active accounts.

For bruteforcing Wordpress with 1 valid and 1 invalid pairs of credentials, we used the following commands:

As shown in the output, Hydra successfully distinguished between invalid and valid credentials.

For the second scenario that used multiple sets of credentials, we used the following Hydra command:

Wordfence was activated after multiple failed attempts, and Hydra generated numerous incorrect credentials.

For the first scenario, we adjusted the following parameters in the interface to run a more focused scan:

• Target: https://wordpress.pentest-ground.com/wp-login.php

• Ports: Use port from target URL

• Services: HTTP

• Wordlists: pa-benchmark

Since the pa-benchmark wordlist includes the valid credentials, the Password Auditor will make 4 attempts against the target - 3 with invalid credentials and one with valid credentials.

The Pentest-Tools.com Password Auditor also includes a screenshot of the logged-in session to confirm the provided credentials are valid.

For the scenario with multiple credentials, we modified the wordlist to include 2 users (1 invalid and 1 valid) and 12 passwords (11 invalid and 1 valid). The Password Auditor reports the IP address was temporarily blocked. 

To automatically avoid IP blocking, you can use the “Delay between attempts” option in the Password Auditor to set a custom delay duration and ensure your attacks are effective and get you the results you need.

You can usually find the Drupal login at the /user/login endpoint.

Use the Network tab in the browser’s Web Developer Tools to identify the login parameters.

After one invalid attempt, the following message is returned:

After 5 invalid login attempts, the protection mechanism is activated, and the account is temporarily blocked.

After multiple failed attempts, the source IP address will be blocked.

In the first scenario, we used the following Hydra commands:

As shown in the output, Hydra accurately identified the invalid and valid credentials.

For the second, more complex scenario, we used the following command:

Drupal activated its protection mechanism after multiple failed attempts, and Hydra was unable to find the valid credentials.

To run a quicker, more focused scan in the first scenario, we adjusted the following parameters:

• Target: https://drupal.pentest-ground.com

• Ports: Use port from target URL

• Services: HTTP

• Wordlists: pa-benchmark

Since the pa-benchmark wordlist includes the valid credentials, the tool will make 4 attempts against the target - 3 with invalid credentials and one with valid credentials.

As shown in the screenshots below, the Pentest-Tools.com Password Auditor successfully identified the valid credentials.

The Password Auditor also includes a screenshot of the logged-in session to confirm that the provided credentials are valid.

For the second scenario, we modified the wordlist to include 2 users (1 invalid and 1 valid) and 12 passwords (11 invalid and 1 valid).

The Password Auditor reported both a temporary account lockout and an IP address block error.

Usually, the Joomla login form is found on the / or on the /index.php/component/users/login endpoints.

Use the Network tab in your browser’s Web Developer Tools to identify the parameters.

The "return" parameter is a base64-encoded URL to which the user will be redirected after a successful login. Decoding this base64 string would reveal the actual URL.

After one invalid attempt, the following message is returned:

After multiple failed attempts, no protection mechanism came up.

In the first scenario, we used the following Hydra commands to bruteforce the Joomla app:

As visible in the output, Hydra failed to distinguish between invalid and valid credentials, marking both as valid.

For the second scenario, we’ve used the following command:

As you can see, Hydra failed to identify any valid credentials, marking all attempts as valid.

For the first scenario, we adjusted the following parameters in the interface to conduct a more focused scan:

• Target: https://joomla.pentest-ground.com

• Ports: Use port from target URL

• Services: HTTP

• Wordlists: pa-benchmark

Since the pa-benchmark wordlist includes the valid credentials, the tool will make 4 attempts against the target - 3 with invalid credentials and one with valid credentials.

As shown in the screenshots below, Password Auditor successfully identified the valid credentials.

The Password Auditor on Pentest-Tools.com also includes a screenshot of the logged-in session to confirm the provided credentials are valid.

For the second scenario, we modified the wordlist to include 2 users (1 invalid and 1 valid) and 12 passwords (11 invalid and 1 valid).

The Password Auditor identified the valid credentials when testing 2 users and 12 passwords.

Usually, Joomla administrator login form is found at /administrator endpoint.

Use the Network tab in Web Developer Tools to identify the parameters.

The "return" parameter is a base64-encoded URL to which the user will be redirected after a successful login. Decoding this base64 string reveals the actual URL.

After one invalid attempt, the following message is returned:

After multiple failed attempts, we didn’t find any protection mechanism. 

In the first 1 set of valid and 1 set of invalid credentials scenario, we used the following Hydra commands:

As shown in the output, Hydra failed to distinguish between invalid and valid credentials, marking both as valid.

For the second, more realistic scenario, we used the following command:

As you can see, Hydra failed to identify any valid credentials.

For the first scenario, we adjusted the following parameters in the interface to perform a more focused scan:

• Target: https://joomla.pentest-ground.com/administrator

• Ports: Use port from target URL

• Services: HTTP

• Wordlists: pa-benchmark

Since the pa-benchmark wordlist includes the valid credentials, the tool will make 4 attempts against the target - 3 with invalid credentials and one with valid credentials.

As shown in the screenshots below, the Password Auditor successfully identified the valid credentials.

The Pentest-Tools.com Password Auditor also provides a screenshot of the logged-in session to confirm that the provided credentials are valid.

For the second scenario, we modified the wordlist to include 2 users (1 invalid and 1 valid) and 12 passwords (11 invalid and 1 valid).

The Password Auditor identified the valid credentials when testing 2 users and 12 passwords.

The default admin login page for PrestaShop is typically located at /admin. However, during installation, PrestaShop prompts you to rename the /admin directory for security reasons. 

The renamed endpoint would look something like /admin123, where admin123 is a randomly generated or manually chosen name. 

Vultr has created the /admin_area/ link as a convenient static URL.

Use the Network tab in Web Developer Tools to identify the parameters.

In PrestaShop, the redirect parameter often contains a CSRF (Cross-Site Request Forgery) token. This is used to ensure the security of redirect actions by verifying they are legitimate and come from a trusted source.

After one invalid attempt, PrestaShop returns the following message:

In the first 1 set of valid and 1 set of invalid credentials scenario, we used the following Hydra commands:

PrestaShop uses the redirect parameter as a CSRF token, which changes with each request. Since Hydra requires this parameter to be configured as static, it cannot generate these tokens. Consequently, Hydra marked both attempts as valid credentials.

Since the first scenario didn't work, we did not proceed with testing the second one.

For the first scenario, these are the parameters we adjusted to perform a more focused scan:

• Target: https://prestashop.pentest-ground.com/admin_area/index.php

• Ports: Use port from target URL

• Services: HTTP

• Wordlists: pa-benchmark

The pa-benchmark wordlist includes valid credentials, so the process involves making four attempts to the target: 3 with invalid credentials and 1 with valid credentials.

The screenshots below show that the Pentest-Tools.com Password Auditor successfully identified the valid credentials.

The Pentest-Tools.com Password Auditor also includes a screenshot of the logged-in session to confirm the provided credentials are valid.

For the second scenario, we only changed the wordlist to include 2 users (1 invalid and 1 valid) and 13 passwords (12 invalid and 1 valid). 

In the second scenario, the Password Auditor on Pentest-Tools.com identified the valid credentials.

The default admin login page for Magento is typically located on the /admin endpoint on port 443.

Use the Network tab in Web Developer Tools to identify the parameters.

In Magento, the form_key parameter is a critical security feature used to prevent Cross-Site Request Forgery (CSRF) attacks. It ensures the form submission is coming from the same site and session, protecting the website and its users from malicious actions.

After one invalid attempt, Magento returns the following message:

The application has a basic anti-brute-force mechanism: the CAPTCHA gets activated after several failed login attempts, and the account can be temporarily disabled.

In the first 1 set of valid and 1 set of invalid credentials scenario, we used the following Hydra commands to bruteforce Magento:

As explained in the section about discovering Magento parameters, the `form_key` is used as a CSRF token and is dynamically set. Hydra cannot use a session to automatically set this parameter, so it incorrectly marks both invalid and valid credentials as valid.

Since the first scenario didn't work, we did not proceed with testing the second one.

For the first scenario, these are the parameters we adjusted to perform a more focused scan:

• Target: http://magento.pentest-ground.com/admin

• Ports: Use port from target URL

• Services: HTTP

• Wordlists: pa-benchmark

The pa-benchmark wordlist includes valid credentials, so the process involves making four attempts to the target: 3 with invalid credentials and 1 with valid credentials.

The screenshots below show that the Pentest-Tools.com Password Auditor successfully identified the valid credentials.

The Password Auditor also provides a screenshot of the logged-in session to verify the validity of the provided credentials.

For the second scenario, we adjusted the wordlist to include 2 users (1 invalid and 1 valid) and 13 passwords (12 invalid and 1 valid). 

Because Magento activated the CAPTCHA mechanism, the Password Auditor on Pentest-Tools.com reported with an informational finding that the bruteforce stopped because of this.