How to bruteforce CMSs and e-commerce apps with Hydra and the Password Auditor
This guide provides real-world testing methodologies for WordPress, Drupal, Joomla, PrestaShop, and Magento, helping you correctly identify weak login endpoints, analyze error messages, and work around security mechanisms for efficient pentests and security assessments.
You’ll find detailed Hydra commands for precise, high-efficiency bruteforcing, along with insights on using our Password Auditor to automate credential testing. This comparison makes it easier to choose which tool can help you brute-forcing faster and more effectively by capturing screenshots of logged-in sessions and generating detailed proof of valid credentials.
How to check Drupal for weak credentials
Deployment method: Vultr marketplace
1. Find the Drupal web app login endpoint
You can usually find the Drupal login at the /user/login endpoint.
2. Discover the Drupal login parameters
Use the Network tab in the browser’s Web Developer Tools to identify the login parameters.
3. Identify error messages and protection mechanisms
After one invalid attempt, the following message is returned:
After 5 invalid login attempts, the protection mechanism is activated, and the account is temporarily blocked.
After multiple failed attempts, the source IP address will be blocked.
Hydra commands and output
In the first scenario, we used the following Hydra commands:
hydra -l benchmark-user -p bad-password drupal.pentest-ground.com -V https-form-post "/user/login/:name=^USER^&pass=^PASS^&form_build_id=form-8B10wX9zca3XsUyefKATrbS3W5C0yAFH0Ko1jIeWg6Q&form_id=user_login_form&op=Log+in:Unrecognized username or password"hydra -l benchmark-user -p tq6nAhfAhqtwBn7WXWqoaMXWF drupal.pentest-ground.com -V https-form-post "/user/login/:name=^USER^&pass=^PASS^&form_build_id=form-8B10wX9zca3XsUyefKATrbS3W5C0yAFH0Ko1jIeWg6Q&form_id=user_login_form&op=Log+in:Unrecognized username or password"
As shown in the output, Hydra accurately identified the invalid and valid credentials.
For the second, more complex scenario, we used the following command:
hydra -L users.txt -P pass.txt drupal.pentest-ground.com -V https-form-post "/user/login/:name=^USER^&pass=^PASS^&form_build_id=form-8B10wX9zca3XsUyefKATrbS3W5C0yAFH0Ko1jIeWg6Q&form_id=user_login_form&op=Log+in:Unrecognized username or password"
Drupal activated its protection mechanism after multiple failed attempts, and Hydra was unable to find the valid credentials.
Password Auditor commands and results
To run a quicker, more focused scan in the first scenario, we adjusted the following parameters:
Ports: Use port from target URL
Services: HTTP
Wordlists: pa-benchmark
Since the pa-benchmark wordlist includes the valid credentials, the tool will make 4 attempts against the target - 3 with invalid credentials and one with valid credentials.
As shown in the screenshots below, the Pentest-Tools.com Password Auditor successfully identified the valid credentials.
The Password Auditor also includes a screenshot of the logged-in session to confirm that the provided credentials are valid.
For the second scenario, we modified the wordlist to include 2 users (1 invalid and 1 valid) and 12 passwords (11 invalid and 1 valid).
The Password Auditor reported both a temporary account lockout and an IP address block error.
Bruteforce commands and settings for Hydra and the Password Auditor
Since every CMS and e-commerce platform handles authentication differently, with varying levels of protection like rate limiting, CAPTCHAs, and account lockouts, you need a tool as flexible and capable as your workflows.
Whether you’re testing a single admin account or running large-scale credential audits, this guide gives you the practical techniques and automation strategies to improve your credential auditing workflow while avoiding unnecessary detection.