Hydra or the Password Auditor: the best tool for brute-force attacks

The Password Auditor on Pentest-Tools.com consistently demonstrated superior accuracy in identifying valid credentials across all 26 web applications. It achieved a 100% success rate when tested with one valid and one invalid credential set. 

Hydra, in contrast, identified only 7 valid credentials with a 27% success rate for the single credential test scenario.

When testing the 26 target apps with multiple credentials (one valid and 10+ invalid ones), the Password Auditor on Pentest-Tools.com maintained a high success rate of 84% in identifying credentials or detecting defensive measures.

In this more complex scenario, Hydra's success rate dropped to 15%, correctly identifying only 4 valid credentials. This suggests Hydra struggles more with identifying valid credentials under varying conditions.

The Password Auditor on Pentest-Tools.com was notably effective in recognizing various defensive mechanisms like IP blacklisting, CAPTCHA, account lockout, and rate limiting. It provided specific feedback and recommendations to bypass or handle these defenses, which is crucial for real-life penetration testing where such measures are common.

Hydra faced challenges with certain applications that use web CSRF tokens or dynamic form protections. Because of its inability to handle client-side JavaScript token generation or CSRF token rotation, Hydra often marked valid and invalid attempts similarly, reducing its effectiveness. Workarounds exist, but they require several tools and do not fit the scope of this benchmark. 

The Password Auditor on Pentest-Tools.com is more user-friendly with a pre-configured interface that simplifies the setup process. Security practitioners just need to specify the target, select the attack type, choose ports, and enable desired services. The tool also allows scheduling regular scans, enhancing its usability.

Hydra requires a more manual setup process, including crafting specific commands to find login endpoints and parameters, which is time-consuming. This setup complexity is a disadvantage in fast-paced testing environments where time efficiency is critical.

The Password Auditor effectively managed to bypass client-side encoding and token mechanisms by using its pre-built configurations. This capability is particularly valuable for auditing web apps that implement client-side protections.

Hydra’s performance dropped significantly on platforms that used client-side hashing or encryption. Since Hydra doesn’t operate within a browser environment, it couldn’t replicate JavaScript-based hashing, limiting its effectiveness against applications like Adobe ColdFusion and JetBrains TeamCity, which use advanced encryption or client-side hashing.

For security specialists looking for a robust, easy-to-use tool with high accuracy in detecting weak credentials and handling modern web application defenses, the Password Auditor on Pentest-Tools.com is a recommended choice. Its high success rates, user-friendly interface, and ability to navigate advanced security mechanisms make it a more reliable option for comprehensive web app auditing.

Hydra remains a powerful tool, especially for scenarios where a more manual, command-line approach is suitable, or when dealing with simpler authentication mechanisms without complex client-side protections. However, for advanced, automated credential auditing across diverse environments, the Password Auditor offers more value and reliability.

The WordPress administrator login usually sits on the /wp-login.php endpoint.

Use the Network tab in the browser’s Web Developer Tools to find the login parameters.

After one invalid attempt, the WordPress app returns the following message:

After 10 invalid attempts, the Wordfence plugin (pre-installed in the deployed environment) gets triggered. Note that the block only works for active accounts.

For bruteforcing Wordpress with 1 valid and 1 invalid pairs of credentials, we used the following commands:

As shown in the output, Hydra successfully distinguished between invalid and valid credentials.

For the second scenario that used multiple sets of credentials, we used the following Hydra command:

Wordfence was activated after multiple failed attempts, and Hydra generated numerous incorrect credentials.

For the first scenario, we adjusted the following parameters in the interface to run a more focused scan:

• Target: https://wordpress.pentest-ground.com/wp-login.php

• Ports: Use port from target URL

• Services: HTTP

• Wordlists: pa-benchmark

Since the pa-benchmark wordlist includes the valid credentials, the Password Auditor will make 4 attempts against the target - 3 with invalid credentials and one with valid credentials.

The Pentest-Tools.com Password Auditor also includes a screenshot of the logged-in session to confirm the provided credentials are valid.

For the scenario with multiple credentials, we modified the wordlist to include 2 users (1 invalid and 1 valid) and 12 passwords (11 invalid and 1 valid). The Password Auditor reports the IP address was temporarily blocked. 

To automatically avoid IP blocking, you can use the “Delay between attempts” option in the Password Auditor to set a custom delay duration and ensure your attacks are effective and get you the results you need.

You can usually find the Drupal login at the /user/login endpoint.

Use the Network tab in the browser’s Web Developer Tools to identify the login parameters.

After one invalid attempt, the following message is returned:

After 5 invalid login attempts, the protection mechanism is activated, and the account is temporarily blocked.

After multiple failed attempts, the source IP address will be blocked.

In the first scenario, we used the following Hydra commands:

As shown in the output, Hydra accurately identified the invalid and valid credentials.

For the second, more complex scenario, we used the following command:

Drupal activated its protection mechanism after multiple failed attempts, and Hydra was unable to find the valid credentials.

To run a quicker, more focused scan in the first scenario, we adjusted the following parameters:

• Target: https://drupal.pentest-ground.com

• Ports: Use port from target URL

• Services: HTTP

• Wordlists: pa-benchmark

Since the pa-benchmark wordlist includes the valid credentials, the tool will make 4 attempts against the target - 3 with invalid credentials and one with valid credentials.

As shown in the screenshots below, the Pentest-Tools.com Password Auditor successfully identified the valid credentials.

The Password Auditor also includes a screenshot of the logged-in session to confirm that the provided credentials are valid.

For the second scenario, we modified the wordlist to include 2 users (1 invalid and 1 valid) and 12 passwords (11 invalid and 1 valid).

The Password Auditor reported both a temporary account lockout and an IP address block error.

Usually, the Joomla login form is found on the / or on the /index.php/component/users/login endpoints.

Use the Network tab in your browser’s Web Developer Tools to identify the parameters.

The "return" parameter is a base64-encoded URL to which the user will be redirected after a successful login. Decoding this base64 string would reveal the actual URL.

After one invalid attempt, the following message is returned:

After multiple failed attempts, no protection mechanism came up.

In the first scenario, we used the following Hydra commands to bruteforce the Joomla app:

As visible in the output, Hydra failed to distinguish between invalid and valid credentials, marking both as valid.

For the second scenario, we’ve used the following command:

As you can see, Hydra failed to identify any valid credentials, marking all attempts as valid.

For the first scenario, we adjusted the following parameters in the interface to conduct a more focused scan:

• Target: https://joomla.pentest-ground.com

• Ports: Use port from target URL

• Services: HTTP

• Wordlists: pa-benchmark

Since the pa-benchmark wordlist includes the valid credentials, the tool will make 4 attempts against the target - 3 with invalid credentials and one with valid credentials.

As shown in the screenshots below, Password Auditor successfully identified the valid credentials.

The Password Auditor on Pentest-Tools.com also includes a screenshot of the logged-in session to confirm the provided credentials are valid.

For the second scenario, we modified the wordlist to include 2 users (1 invalid and 1 valid) and 12 passwords (11 invalid and 1 valid).

The Password Auditor identified the valid credentials when testing 2 users and 12 passwords.

Usually, Joomla administrator login form is found at /administrator endpoint.

Use the Network tab in Web Developer Tools to identify the parameters.

The "return" parameter is a base64-encoded URL to which the user will be redirected after a successful login. Decoding this base64 string reveals the actual URL.

After one invalid attempt, the following message is returned:

After multiple failed attempts, we didn’t find any protection mechanism. 

In the first 1 set of valid and 1 set of invalid credentials scenario, we used the following Hydra commands:

As shown in the output, Hydra failed to distinguish between invalid and valid credentials, marking both as valid.

For the second, more realistic scenario, we used the following command:

As you can see, Hydra failed to identify any valid credentials.

For the first scenario, we adjusted the following parameters in the interface to perform a more focused scan:

• Target: https://joomla.pentest-ground.com/administrator

• Ports: Use port from target URL

• Services: HTTP

• Wordlists: pa-benchmark

Since the pa-benchmark wordlist includes the valid credentials, the tool will make 4 attempts against the target - 3 with invalid credentials and one with valid credentials.

As shown in the screenshots below, the Password Auditor successfully identified the valid credentials.

The Pentest-Tools.com Password Auditor also provides a screenshot of the logged-in session to confirm that the provided credentials are valid.

For the second scenario, we modified the wordlist to include 2 users (1 invalid and 1 valid) and 12 passwords (11 invalid and 1 valid).

The Password Auditor identified the valid credentials when testing 2 users and 12 passwords.

Usually, phpMyAdmin login form is found at /mysqladmin/ or /phpmyadmin/ endpoint.

In your browser, go to the Network tab in Web Developer Tools to identify the parameters.

In phpMyAdmin, the token parameter is a security feature used to prevent Cross-Site Request Forgery (CSRF) attacks. This parameter ensures each request to phpMyAdmin is valid and comes from a user session.

After one invalid attempt, the following message is returned:

After multiple failed attempts, we didn’t find any protection mechanism. 

In the first scenario, we used the following Hydra commands:

Because the token parameter acts as a CSRF token, as shown in the output, Hydra failed to distinguish between invalid and valid credentials, marking both as valid.

Since the first scenario didn't work, we did not proceed with testing the second one.

For the first scenario, we adjusted the following parameters in the interface to conduct a more focused scan:

• Target: https://wordpress.pentest-ground.com/mysqladmin/

• Ports: Use port from target URL

• Services: HTTP

• Wordlists: pa-benchmark

Since the pa-benchmark wordlist includes the valid credentials, the tool will make 4 attempts against the target - 3 with invalid credentials and one with valid credentials.

As shown in the screenshots below, Password Auditor successfully identified the valid credentials.

The Password Auditor automatically includes a screenshot of the logged-in session to confirm the provided credentials are valid.

For the second, more realistic scenario, we modified the wordlist to include 3 users (1 invalid and 2 valid) and 13 passwords (12 invalid and 1 valid).

Usually, we can find the cPanel WHM form at the / or the /login endpoint on port 2087.

Use the Network tab in Web Developer Tools to identify the parameters.

After one invalid attempt, the following message is returned:

After multiple failed attempts, we didn’t find any protection mechanism. 

We used the following commands to bruteforce the cPanel WHM app with Hydra with one pair of valid credentials and one pair of invalid ones:

As the output shows, Hydra successfully identified the valid credentials. However, it cannot perform a brute-force attack on invalid credentials because the login returns a 401 status code, causing Hydra to mistakenly assume the target app is using basic authentication.

For the more complex, more realistic scenario, we used the following Hydra command:

As you can see, Hydra failed to identify any valid credentials because of the previously mentioned scenario.

For the first scenario, we adjusted the following parameters in the interface to conduct a more focused scan:

• Target: https://cpanel.pentest-ground.com:2087/login/

• Ports: Use port from target URL

• Services: HTTP

• Wordlists: pa-benchmark

Since the pa-benchmark wordlist includes the valid credentials, four attempts were made to the target (three with invalid credentials and one with valid credentials).

As shown in the screenshots below, the Password Auditor successfully identified the valid credentials.

What’s more, the Password Auditor includes a screenshot of the logged-in session to confirm the provided credentials are valid.

For the second scenario, we only changed the wordlist to include 2 users (1 invalid and 1 valid) and 14 passwords (13 invalid and 1 valid).

The Password Auditor identified the valid credentials when testing 2 users and 12 passwords.

You can usually find the cPanel login form at the / or /login endpoints on port 2083.

Use the Network tab in Web Developer Tools to identify the parameters.

After one invalid attempt, the following message is returned:

After multiple failed attempts, we didn’t detect any protection mechanism.

In the first scenario, we used the following Hydra commands:

As you can see from the output, Hydra identified the valid credentials, but on invalid credentials it can’t perform the bruteforce attack since the login returns 401 status code and it thinks it uses basic authentication.

For the second, more realistic scenario, we used the following command:

As you can see, Hydra failed to identify any valid credentials because of the previously mentioned scenario.

For the first scenario, we adjusted the following parameters in the interface to conduct a more focused scan:

• Target: https://cpanel.pentest-ground.com:2083/login/

• Ports: Use port from target URL

• Services: HTTP

• Wordlists: pa-benchmark

Since the pa-benchmark wordlist includes the valid credentials, the tool will make 4 attempts against the target - 3 with invalid credentials and one with valid credentials.

As the screenshots below reveals, the Password Auditor successfully identified the valid credentials.

What’s more, the Password Auditor included a screenshot of the logged-in session to confirm the provided credentials are valid.

For the second scenario, we only modified the wordlist to include 2 users (1 invalid and 1 valid) and 14 passwords (13 invalid and 1 valid).

The Password Auditor identified the valid credentials when testing 2 users and 12 passwords.

Usually, the Jira login form is found at the /login.jsp endpoint .

Use the Network tab in Web Developer Tools to identify the parameters.

After one invalid attempt, the following message is returned:

After two failed attempts, the CAPTCHA is activated.

In the first scenario, we used the following commands:

As you can see from the output, Hydra validly identified both the invalid and the valid credentials.

The following command is what we used for the second scenario, with multiple usernames and passwords:

Jira activated the CAPTCHA mechanism during the brute-force attack, preventing Hydra from identifying any valid credentials and causing it to mark all credentials as valid.

For the first scenario, these are the parameters we adjusted to perform a more focused scan:

• Target: http://jira.pentest-ground.com:8080/login.jsp

• Ports: Use port from target URL

• Services: HTTP

• Wordlists: pa-benchmark

Because the pa-benchmark wordlist includes the valid credentials, the tool will make 4 attempts against the target - 3 with invalid credentials and one with valid credentials.

As the screenshot below shows, the Password Auditor successfully identified the valid credentials.

Additionally, it also provided a screenshot of the logged-in session to confirm the tested credentials are valid.

In the second scenario, we only adjusted the wordlist to include 2 users (1 invalid and 1 valid) and 14 passwords (13 invalid and 1 valid).

The Password Auditor reported the Jira server activated its CAPTCHA protection. In the Details section, we recommend using the Password Spray attack type or splitting the scan into multiple scans with smaller wordlists.

The Bitbucket login form usually sits on the /login endpoint.

Use the Network tab in Web Developer Tools to identify the parameters.

After one invalid attempt, the following message is returned:

After two failed attempts, the CAPTCHA is activated.

We used the following commands to bruteforce Bitbucket with Hydra with one pair of valid credentials and one pair of invalid ones:

As shown in the output, Hydra correctly identified both invalid and valid credentials.

For the second scenario with multiple usernames and passwords, we used the following command:

Hydra identified the valid credentials when testing 2 users and 13 passwords.

For the first scenario, these are the parameters we adjusted to perform a more focused scan:

• Target: http://bitbucket.pentest-ground.com:7990/login

• Ports: Use port from target URL

• Services: HTTP

• Wordlists: pa-benchmark

Because the pa-benchmark wordlist includes the valid credentials, the tool will make 4 attempts against the target - 3 with invalid credentials and one with valid credentials.

As the screenshot below shows, the Password Auditor successfully identified the valid credentials.

It also delivered a screenshot of the logged-in session to confirm the provided credentials are valid.

For the second scenario, we modified the wordlist to include 2 users (1 invalid and 1 valid) and 12 passwords (11 invalid and 1 valid).

The Password Auditor reports that the Bitbucket server activated its CAPTCHA protection. In the Details section, we recommend using the Password Spray attack type or splitting the scan into multiple scans with smaller wordlists.

Usually, Confluence login form sits at the /login.action endpoint.

Use the Network tab in Web Developer Tools to identify the parameters.

After one invalid attempt, the Confluence server returns the following message:

After 3 failed attempts, the CAPTCHA activates.

For the first scenario, we used the following commands to bruteforce Confluence with Hydra:

As you can see from the output, Hydra validly identified both the invalid and the valid credentials.

For the second bruteforcing scenario, we used the following command:

Hydra identified the valid credentials, when 2 users and 13 passwords were tested.

For the first scenario, these are the parameters we adjusted to perform a more focused scan:

• Target: http://confluence.pentest-ground.com:8090/dologin.action

• Ports: Use port from target URL

• Services: HTTP

• Wordlists: pa-benchmark

Because the pa-benchmark wordlist includes the valid credentials, the tool will make 4 attempts against the target - 3 with invalid credentials and one with valid credentials.

As highlighted in the screenshots below, the Password Auditor successfully identified the valid credentials.

The tool also included a screenshot of the logged-in session to confirm the validity of the provided credentials.

For the second scenario, we modified the wordlist to include 2 users (1 invalid and 1 valid) and 12 passwords (11 invalid and 1 valid).

Finally, the Password Auditor reports that the Confluence server activated its CAPTCHA protection. In the Details section, we recommend using the Password Spray attack type or splitting the scan into multiple scans with smaller wordlists.

You can usually find the Exchange login form at the /owa/auth/logon.aspx endpoint.

Use Burp Community Edition to determine the parameters.

After one invalid attempt, the Microsoft Exchange returns the following message:

In the first scenario, we used the following Hydra commands:

As you can see from the output, Hydra did not identify the invalid and valid credentials, marking both as valid credentials.

For the second scenario with multiple usernames and passwords, we used the following command:

When testing 2 users and 13 passwords, Hydra failed to differentiate between invalid and valid credentials, marking all as valid.

For the first scenario, these are the parameters we adjusted to perform a more focused scan:

• Target: https://mail.pentest-ground.com/owa/auth/logon.aspx

• Ports: Use port from target URL

• Services: HTTP

• Wordlists: pa-benchmark

As the pa-benchmark wordlist includes the valid credentials, the tool will make 4 attempts against the target - 3 with invalid credentials and one with valid credentials.

The Password Auditor successfully identified the valid credentials, as visible in these screenshots.

A screenshot of the logged-in session offers additional confirmation that the provided credentials are valid.

For the second scenario, we modified the wordlist to include 2 users (1 invalid and 1 valid) and 12 passwords (11 invalid and 1 valid).

The Password Auditor accurately identified the valid credentials when testing 2 users and 12 passwords.

Usually, the Plesk login form sits on the /login endpoint on port 8443.

Use the Network tab in Web Developer Tools to identify the parameters.

After one invalid attempt, the following message is returned:

After 5 invalid credentials, the IP address got blocked:

Hydra was not able to brute force Plesk because of its multipart body format. There is already an open issue for this on their official Github repository.

For the first scenario, these are the parameters we adjusted to perform a more focused scan:

• Target: https://mail.pentest-ground.com/owa/auth/logon.aspx

• Ports: Use port from target URL

• Services: HTTP

• Wordlists: pa-benchmark

As the pa-benchmark wordlist includes the valid credentials, the tool will make 4 attempts against the target - 3 with invalid credentials and one with valid credentials.

As shown in the screenshots below, Password Auditor successfully identified the valid credentials.

Additionally, the Password Auditor includes a screenshot of the logged-in session in its results to confirm the provided credentials are valid.

For the second scenario, we used a wordlist with 2 users (1 invalid and 1 valid) and 12 passwords (11 invalid and 1 valid).

Because the scanner’s source IP address was blocked, the Pentest-Tools.com Password Auditor was unable to identify the valid credentials. However, it reported that website access was blocked after 6 attempts.

The Jenkins login form is usually found on the /login endpoint.

Use the Network tab in Web Developer Tools to identify the parameters.

After one invalid attempt, Jenkins returns the following message:

In the first scenario, we used the following Hydra commands to bruteforce Jenkins:

As shown in the output, Hydra failed to identify the invalid and valid credentials, marking both as invalid.

For the second, multi-credentials scenario, we used the following Hydra command:

When testing 2 users and 13 passwords, Hydra failed to identify the invalid and valid credentials, marking all as invalid.

For the first scenario, these are the parameters we adjusted to perform a more focused scan:

• Target: https://jenkins.pentest-ground.com/login

• Ports: Use port from target URL

• Services: HTTP

• Wordlists: pa-benchmark

The pa-benchmark wordlist includes valid credentials, so the process involves making four attempts to the target: 3 with invalid credentials and 1 with valid credentials.

The screenshots below show that Password Auditor successfully identified the valid credentials.

The Password Auditor provides a screenshot of the logged-in session to verify the validity of the provided credentials.

For the second scenario, we modified the wordlist to include 2 users (1 invalid and 1 valid) and 12 passwords (11 invalid and 1 valid).

The Password Auditor identified the valid credentials when testing 2 users and 12 passwords.

Usually, the Grafana login form sits on the /login endpoint.

Use the Network tab in Web Developer Tools to identify the parameters.

After one invalid attempt, Grafana returns the following message:

The login form seems to shadow ban your IP after multiple failed login attempts. You still get the “Invalid username or password” message in the browser even if you use the correct credentials.

In the first 1 set of valid and 1 set of invalid credentials scenario, we used the following Hydra commands:

As you can see from the output, the server returned a 401 status code and suggested to use the “http-get” module. Using http-get, Hydra returned [ERROR] Caught unknown return code, exiting!.

We did not test the second scenario since the first one did not work.

For the first scenario, these are the parameters we adjusted to perform a more focused scan:

• Target: http://grafana.pentest-ground.com:3000/login

• Ports: Use port from target URL

• Services: HTTP

• Wordlists: pa-benchmark

The pa-benchmark wordlist includes valid credentials, so the process involves making four attempts to the target: 3 with invalid credentials and 1 with valid credentials.

The screenshots below demonstrate that the Password Auditor successfully identified the valid credentials.

The Password Auditor provides a screenshot of the logged-in session to verify the validity of the provided credentials.

For the second scenario, we modified the wordlist to include 2 users (1 invalid and 1 valid) and 12 passwords (11 invalid and 1 valid).

The Password Auditor couldn’t identify the valid credentials when testing 2 users and 12 passwords because of the shadow IP blacklisting.

You can customarily find the Webmin login form on the / endpoint on port 10000.

Use the Network tab in Web Developer Tools to identify the parameters.

After one invalid attempt, Webmin returns the following message:

After more than 5 invalid tries, the IP got blocked.

In the first 1 set of valid and 1 set of invalid credentials scenario, we used the following Hydra commands:

As you can see from the output, Hydra marked both tries as valid credentials.

We did not test the second scenario since the first one did not work.

For the first scenario, these are the parameters we adjusted to perform a more focused scan:

• Target: https://webmin.pentest-ground.com:10000

• Ports: Use port from target URL

• Services: HTTP

• Wordlists: pa-benchmark

The pa-benchmark wordlist includes valid credentials, so the process involves making four attempts to the target: 3 with invalid credentials and 1 with valid credentials.

The screenshots below show that the Pentest-Tools.com Password Auditor successfully identified the valid credentials.

The Password Auditor also provides a screenshot of the logged-in session to verify the validity of the provided credentials.

For the second scenario, the wordlist we used included 2 users (1 invalid and 1 valid) and 12 passwords (11 invalid and 1 valid).

Because Webmin activated its protection mechanism and blocked the scanner's source IP address, the Password Auditor was unable to identify the valid credentials. However, it reported the block as an informational finding.

The Kibana login form often sits on the /login endpoint on port 5601.

Use the Network tab in Web Developer Tools to identify the parameters.

After one invalid attempt, Kibana returns the following message:

In the first 1 set of valid and 1 set of invalid credentials scenario, we used the following Hydra commands:

As you can see from the output, Hydra marked both tries as invalid credentials.

Since the first scenario didn't work, we did not proceed with testing the second one.

For the first scenario, these are the parameters we adjusted to perform a more focused scan:

• Target: http://kibana.pentest-ground.com:5601

• Ports: Use port from target URL

• Services: HTTP

• Wordlists: pa-benchmark

The pa-benchmark wordlist includes valid credentials, so the process involves making four attempts to the target: 3 with invalid credentials and 1 with valid credentials.

The screenshots below show that the Pentest-Tools.com Password Auditor successfully identified the valid credentials.

The Password Auditor also provides a screenshot of the logged-in session to verify the validity of the provided credentials.

For the second scenario, we modified the wordlist to include 2 users (1 invalid and 1 valid) and 12 passwords (11 invalid and 1 valid).

The Password Auditor identified the valid credentials when testing 2 users and 12 passwords.

You will usually find the Adobe Coldfusion login form at the /CFIDE/administrator/index.cfm endpoint on port 8500.

Use the Network tab in Web Developer Tools to identify the parameters.

When a user submits a password to an Adobe ColdFusion application, a JavaScript function in the user's web browser hashes the password on the client-side before transmitting it to the server. This prevents the password from being sent in plain text over the network.

The client-side hashing mechanism uses a combination of the following:

• MD5 hashing: The password is first hashed using the MD5 algorithm, which produces a 32-character hexadecimal string.

• Salt value: A random salt value that the Adobe ColdFusion server generates is appended to the MD5-hashed password. The salt value prevents rainbow table attacks.

• Base64 encoding: The resulting string (MD5 hash + salt value) is then Base64 encoded to produce a final hashed password string.

The ColdFusion server receives the hashed password string and either stores it in a database or compares it to an existing hash value for authentication.

After one invalid attempt, Adobe ColdFusion returns the following message:

In the first 1 set of valid and 1 set of invalid credentials scenario, we used the following Hydra commands:

Unfortunately, as mentioned in the “Find the web app login endpoint for Adobe ColdFusion” section for this application, the password is hashed client-side, and Hydra cannot use the JavaScript function available in a browser to hash the password. As a result, Hydra cannot identify valid credentials on Adobe ColdFusion.

Since the first scenario didn't work, we didn’t go forward with testing the second one.

For the first scenario, these are the parameters we adjusted to perform a more focused scan:

• Target: http://coldfusion.pentest-ground.com:8500/CFIDE/administrator/index.cfm

• Ports: Use port from target URL

• Services: HTTP

• Wordlists: pa-benchmark

The pa-benchmark wordlist includes valid credentials, so the process involves making four attempts to the target: 3 with invalid credentials and 1 with valid credentials.

The screenshots below show that the Pentest-Tools.com Password Auditor successfully identified the valid credentials.

The Password Auditor also provides a screenshot of the logged-in session to verify the validity of the provided credentials.

For the second scenario, we modified the wordlist to include 2 users (1 invalid and 1 valid) and 12 passwords (11 invalid and 1 valid). 

The Password Auditor identified the valid credentials when testing 2 users and 12 passwords.

Usually, you can find the Zabbix login form on the / endpoint on port 80 or 443.

Use the Network tab in Web Developer Tools to identify the parameters.

After one invalid attempt, Zabbix returns the following message:

After 5 incorrect credentials, the user gets temporarily blocked. From our tests, the lock duration was about 5 minutes.

In the first 1 set of valid and 1 set of invalid credentials scenario, we used the following Hydra commands:

Hydra successfully identified the valid credentials.

For the second, more realistic scenario, we used the following command:

Hydra identified the valid credentials, when 2 users and 13 passwords were tested.

For the first scenario, these are the parameters we adjusted to perform a more focused scan:

• Target: http://zabbix.pentest-ground.com/

• Ports: Use port from target URL

• Services: HTTP

• Wordlists: pa-benchmark

The pa-benchmark wordlist includes valid credentials, so the process involves making four attempts to the target: 3 with invalid credentials and 1 with valid credentials.

The screenshots below show that the Pentest-Tools.com Password Auditor successfully identified the valid credentials.

The Password Auditor also provides a screenshot of the logged-in session to verify the validity of the provided credentials.

For the second scenario, we modified the wordlist to include 2 users (1 invalid and 1 valid) and 12 passwords (11 invalid and 1 valid). 

Because of the temporary lockout mechanism, the Pentest-Tools.com Password Auditor couldn’t identify the valid credentials with 2 users and 12 passwords.

Usually, the Weblogic login form sits on the /console/login/LoginForm.jsp endpoint on port 7001.

Use the Network tab in Web Developer Tools to identify the parameters.

After one invalid attempt, Oracle Weblogic returns the following message:

After 5 invalid login attempts to the Oracle Weblogic server, the user gets locked out for 30 minutes. 

In the first 1 set of valid and 1 set of invalid credentials scenario, we used the following Hydra commands to bruteforce Oracle Weblogic:

For the second scenario using multiple credentials, we used the following command:

Because Oracle WebLogic locks out the user for 30 minutes after 5 invalid attempts, Hydra did not identify the valid credentials when testing 2 users and 13 passwords.

For the first scenario, these are the parameters we adjusted to perform a more focused scan:

• Target: http://weblogic.pentest-ground.com:7001/console/login/LoginForm.jsp

• Ports: Use port from target URL

• Services: HTTP

• Wordlists: pa-benchmark

The pa-benchmark wordlist includes valid credentials, so the process involves making four attempts to the target: 3 with invalid credentials and 1 with valid credentials.

The Password Auditor also provides a screenshot of the logged-in session to verify the validity of the provided credentials.

For the second scenario, we modified the wordlist to include 2 users (1 invalid and 1 valid) and 12 passwords (11 invalid and 1 valid). 

Because Oracle Weblogic locked out the user for 30 minutes after 5 invalid attempts, the Pentest-Tools.com Password Auditor didn’t identify the valid credentials, when testing the target app with 2 users and 13 passwords.

Most often, the Gitlab CE login form sits on the /users/sign_in endpoint on port 80 or port 443.

Use the Network tab in Web Developer Tools to identify the parameters.

Note that GitLab CE uses authenticity_token as a CSRF token.

After one invalid attempt, Gitlab Community Edition returns the following message:

The login form seems to shadow ban your IP after multiple failed login attempts. You still get the Login failed message in the browser even if you use the correct credentials.

In the first 1 set of valid and 1 set of invalid credentials scenario, we used the following Hydra commands:

GitLab uses authenticity_token as a CSRF token, which is different for each request. Since Hydra requires this parameter to be configured as static, it cannot generate these tokens. Consequently, Hydra marked both attempts as valid credentials.

Since the first scenario didn't work, we did not proceed with testing the second one.

For the first scenario, these are the parameters we adjusted to perform a more focused scan:

• Target: http://gitlab.pentest-ground.com/users/sign_in

• Ports: Use port from target URL

• Services: HTTP

• Wordlists: pa-benchmark

The pa-benchmark wordlist includes valid credentials, so the process involves making four attempts to the target: 3 with invalid credentials and 1 with valid credentials.

The screenshots below show that the Pentest-Tools.com Password Auditor successfully identified the valid credentials.

The Password Auditor also provides a screenshot of the logged-in session to verify the validity of the provided credentials.

For the second scenario, we modified the wordlist to include 2 users (1 invalid and 1 valid) and 12 passwords (11 invalid and 1 valid). 

As mentioned in the Identify error messages and protection mechanisms section, it seems that the target shadow bans the source IP of the attack. Therefore, the Password Auditor didn’t identify the valid credentials, when testing the target app with 2 users and 13 passwords.

The default admin login page for PrestaShop is typically located at /admin. However, during installation, PrestaShop prompts you to rename the /admin directory for security reasons. 

The renamed endpoint would look something like /admin123, where admin123 is a randomly generated or manually chosen name. 

Vultr has created the /admin_area/ link as a convenient static URL.

Use the Network tab in Web Developer Tools to identify the parameters.

In PrestaShop, the redirect parameter often contains a CSRF (Cross-Site Request Forgery) token. This is used to ensure the security of redirect actions by verifying they are legitimate and come from a trusted source.

After one invalid attempt, PrestaShop returns the following message:

In the first 1 set of valid and 1 set of invalid credentials scenario, we used the following Hydra commands:

PrestaShop uses the redirect parameter as a CSRF token, which changes with each request. Since Hydra requires this parameter to be configured as static, it cannot generate these tokens. Consequently, Hydra marked both attempts as valid credentials.

Since the first scenario didn't work, we did not proceed with testing the second one.

For the first scenario, these are the parameters we adjusted to perform a more focused scan:

• Target: https://prestashop.pentest-ground.com/admin_area/index.php

• Ports: Use port from target URL

• Services: HTTP

• Wordlists: pa-benchmark

The pa-benchmark wordlist includes valid credentials, so the process involves making four attempts to the target: 3 with invalid credentials and 1 with valid credentials.

The screenshots below show that the Pentest-Tools.com Password Auditor successfully identified the valid credentials.

The Pentest-Tools.com Password Auditor also includes a screenshot of the logged-in session to confirm the provided credentials are valid.

For the second scenario, we only changed the wordlist to include 2 users (1 invalid and 1 valid) and 13 passwords (12 invalid and 1 valid). 

In the second scenario, the Password Auditor on Pentest-Tools.com identified the valid credentials.

The default admin login page for JetBrains TeamCity is typically located on the /login.html endpoint on port 8111.

Use the Network tab in Web Developer Tools to identify the parameters.

In JetBrains TeamCity, the login page uses the publicKey and encryptedPassword parameters as part of the authentication process to enhance security. 

Here's a brief explanation of each concept:

• publicKey: This is the public portion of a key pair (public/private key) used for RSA encryption. JetBrains TeamCity provides this public key to the client (browser) during the login process. The public key is used to encrypt sensitive information, specifically the password, before it gets sent to the server. This helps protect the password during transmission, even if the data is intercepted.

• encryptedPassword: This is the user's password, encrypted using the RSA public key provided by TeamCity. When a user enters their password, it is encrypted client-side using JavaScript with the public key. The resulting encryptedPassword value is then sent to the server instead of the plain text password. On the server side, TeamCity uses the corresponding private key to decrypt the password and authenticate the user.

This mechanism prevents the plain text password from being exposed during transmission, adding an extra layer of security against potential interception or eavesdropping attacks.

After one invalid attempt, JetBrains TeamCity returns the following message:

After 5 failed login attempts, the user gets locked out for 1 minute.

Since Hydra can’t use the Javascript that encrypts the password using the public key, we considered that the scenarios cannot be tested.

For the first scenario, these are the parameters we adjusted to perform a more focused scan:

• Target: http://teamcity.pentest-ground.com:8111/login.html

• Ports: Use port from target URL

• Services: HTTP

• Wordlists: pa-benchmark

The pa-benchmark wordlist includes valid credentials, so the process involves making four attempts to the target: 3 with invalid credentials and 1 with valid credentials.

As shown in the screenshots below, the Password Auditor on Pentest-Tools.com successfully identified the valid credentials.

The Password Auditor also provides a screenshot of the logged-in session to verify the validity of the provided credentials.

For the second scenario, we adjusted the wordlist to contain 2 users (1 invalid and 1 valid) and 13 passwords (12 invalid and 1 valid). 

JetBrains TeamCity temporarily locks the account/source IP and the Password Auditor can’t identify the valid credentials. 

The default admin login page for F5 BIG-IP is typically located on the  /tmui/login.jsp endpoint on port 8443 or 443.

Use the Network tab in Web Developer Tools to identify the parameters.

After one invalid attempt, F5 BIG-IP returns the following message:

In the first 1 set of valid and 1 set of invalid credentials scenario, we used the following Hydra commands:

Hydra suggests using the https-get module, since the application returned 401 HTTP error code.

Since the first scenario didn't work, we did not proceed with testing the second one.

For the first scenario, these are the parameters we adjusted to perform a more focused scan:

• Target: https://big-ip.pentest-ground.com:8443/tmui/login.jsp

• Ports: Use port from target URL

• Services: HTTP

• Wordlists: pa-benchmark

The pa-benchmark wordlist includes valid credentials, so the process involves making four attempts to the target: 3 with invalid credentials and 1 with valid credentials.

As shown in the screenshots below, Password Auditor successfully identified the valid credentials.

The Password Auditor also provides a screenshot of the logged-in session to verify the validity of the provided credentials.

For the second scenario, we only adjusted the wordlist to include 2 users (1 invalid and 1 valid) and 13 passwords (12 invalid and 1 valid). 

In the second scenario, the Password Auditor on Pentest-Tools.com identified the valid credentials.

The default admin login page for Roxy-WI is typically located on the /app/login.py endpoint on port 443.

Use the Network tab in Web Developer Tools to identify the parameters.

After one invalid attempt, Roxy-WI returns the following message:

The Roxy-WI application has a minimal anti-bruteforce mechanism because the login button gets disabled for just 10 seconds when you enter an invalid set of credentials.

In the first 1 set of valid and 1 set of invalid credentials scenario, we used the following Hydra commands:

The server returns an HTTP status code of 200 with the text "ban" when it receives invalid credentials. This response confuses Hydra, leading it to consider the login attempt successful.

Since the first scenario didn't work, we did not proceed with testing the second one.

For the first scenario, these are the parameters we adjusted to perform a more focused scan:

• Target: https://roxy-wi.pentest-ground.com/app/login.py

• Ports: Use port from target URL

• Services: HTTP

• Wordlists: pa-benchmark

The pa-benchmark wordlist includes valid credentials, so the process involves making four attempts to the target: 3 with invalid credentials and 1 with valid credentials.

The screenshots below show that the Pentest-Tools.com Password Auditor successfully identified the valid credentials.

The Password Auditor also provides a screenshot of the logged-in session to verify the validity of the provided credentials.

For the second scenario, we only changed the wordlist to include 2 users (1 invalid and 1 valid) and 13 passwords (12 invalid and 1 valid). 

In the second scenario, the Password Auditor identified all the valid credentials.

The default admin login page for Magento is typically located on the /admin endpoint on port 443.

Use the Network tab in Web Developer Tools to identify the parameters.

In Magento, the form_key parameter is a critical security feature used to prevent Cross-Site Request Forgery (CSRF) attacks. It ensures the form submission is coming from the same site and session, protecting the website and its users from malicious actions.

After one invalid attempt, Magento returns the following message:

The application has a basic anti-brute-force mechanism: the CAPTCHA gets activated after several failed login attempts, and the account can be temporarily disabled.

In the first 1 set of valid and 1 set of invalid credentials scenario, we used the following Hydra commands to bruteforce Magento:

As explained in the section about discovering Magento parameters, the `form_key` is used as a CSRF token and is dynamically set. Hydra cannot use a session to automatically set this parameter, so it incorrectly marks both invalid and valid credentials as valid.

Since the first scenario didn't work, we did not proceed with testing the second one.

For the first scenario, these are the parameters we adjusted to perform a more focused scan:

• Target: http://magento.pentest-ground.com/admin

• Ports: Use port from target URL

• Services: HTTP

• Wordlists: pa-benchmark

The pa-benchmark wordlist includes valid credentials, so the process involves making four attempts to the target: 3 with invalid credentials and 1 with valid credentials.

The screenshots below show that the Pentest-Tools.com Password Auditor successfully identified the valid credentials.

The Password Auditor also provides a screenshot of the logged-in session to verify the validity of the provided credentials.

For the second scenario, we adjusted the wordlist to include 2 users (1 invalid and 1 valid) and 13 passwords (12 invalid and 1 valid). 

Because Magento activated the CAPTCHA mechanism, the Password Auditor on Pentest-Tools.com reported with an informational finding that the bruteforce stopped because of this.

The default admin login page for CloudPanel is typically located on the /login endpoint on port 8443.

Use the Network tab in Web Developer Tools to identify the parameters.

In Cloudpanel, the csrftoken parameter is a critical security feature used to prevent Cross-Site Request Forgery (CSRF) attacks. It ensures the form submission is coming from the same site and session, protecting the website and its users from malicious actions.

After one invalid attempt, CloudPanel returns the following message:

In the first 1 set of valid and 1 set of invalid credentials scenario, we used the following Hydra commands:

As explained in the login parameters discovery section, the csrftoken is used as a CSRF token and is dynamically set. Since Hydra cannot use a session to automatically set this parameter, it marks both invalid and valid credentials as valid.

Since the first scenario didn't work, we did not proceed with testing the second one.

For the first scenario, these are the parameters we adjusted to perform a more focused scan:

• Target: https://cloudpanel.pentest-ground.com:8443/login

• Ports: Use port from target URL

• Services: HTTP

• Wordlists: pa-benchmark

The pa-benchmark wordlist includes valid credentials, so the process involves making four attempts to the target: 3 with invalid credentials and 1 with valid credentials.

The screenshots below show that the Pentest-Tools.com Password Auditor successfully identified the valid credentials.

The Password Auditor also provides a screenshot of the logged-in session to verify the validity of the provided credentials.

For the second scenario, we just changed the wordlist to include 2 users (1 invalid and 1 valid) and 13 passwords (12 invalid and 1 valid). 

In the second scenario, the Password Auditor on Pentest-Tools.com identified the valid credentials.

Based on the results from this comparison, you can select the right tool for bruteforcing credentials based on the type of system or web application you’re targeting (e.g., WordPress, Drupal, Joomla).

Case in point, the Password Auditor demonstrated superior performance across more complex login scenarios (e.g., dynamic forms, CAPTCHA, IP blocking), while Hydra was more limited in handling client-side security mechanisms like JavaScript hashing.

If you need an automated tool for auditing web apps with a focus on ease of use and minimal configuration, the Password Auditor is a reliable choice. You can simply select the attack type (dictionary or password spray), enable services, and configure the port range to launch scans quickly.

The tool’s ability to schedule regular scans and automate credential auditing across multiple targets makes it a valuable tool for large-scale projects. You can automate routine checks for weak credentials and have reports generated without manual intervention. This helps manage multiple clients or a large number of assets efficiently.

Many web applications, such as Jira, Bitbucket, or Microsoft Exchange, use unique login forms and parameters. The comparison outlines specific commands and configurations for each tool, allowing you to adapt your brute-force attacks to each application’s setup.

For instance, Hydra requires manual setup but allows for deep configuration of attacks, making it suitable when you need fine-tuned control over the process, especially in simpler environments that don’t implement client-side security mechanisms.

The comparison reveals that the Password Auditor is more effective at recognizing defensive mechanisms like CAPTCHA and IP blocking and providing bypass recommendations. You can use this capability to audit web apps that deploy such protections.

Both the Password Auditor and Hydra can set delays between attempts to avoid triggering account lockouts or rate-limiting mechanisms. This feature is useful for flying under the radar while performing brute-force attacks, reducing the risk of detection.

This comparison shows how both Hydra and the Password Auditor detect login endpoints and error messages, a critical first step in assessing web applications for brute-force vulnerabilities. You can compare their effectiveness and accuracy to choose the most reliable tool for simulating attacks against your targets. 

The comparison shows how the Password Auditor was able to bypass complex security mechanisms like client-side encryption and token generation. This makes it ideal for environments like Adobe ColdFusion where Hydra failed because it was unable to replicate client-side security processes.

The Password Auditor provides detailed feedback on defenses it encounters during an attack, including IP blacklisting, CAPTCHA, and login attempt delays. This level of detail allows you to generate comprehensive reports for clients or colleagues, outlining the strength of their authentication defenses and the bypasses that can override them.

These detailed comparison results offer a benchmark for future bruteforce testing. By understanding how each tool performed across the 26 tested applications, you can set realistic expectations for similar tools or when using Hydra or the Password Auditor in your environment.