How to bruteforce CMSs and e-commerce apps with Hydra and the Password Auditor
This guide provides real-world testing methodologies for WordPress, Drupal, Joomla, PrestaShop, and Magento, helping you correctly identify weak login endpoints, analyze error messages, and work around security mechanisms for efficient pentests and security assessments.
You’ll find detailed Hydra commands for precise, high-efficiency bruteforcing, along with insights on using our Password Auditor to automate credential testing. This comparison makes it easier to choose which tool can help you brute-forcing faster and more effectively by capturing screenshots of logged-in sessions and generating detailed proof of valid credentials.
How to check Joomla login for weak credentials
Deployment method: Vultr marketplace
1. Find the Joomla web app login endpoint
Usually, the Joomla login form is found on the / or on the /index.php/component/users/login endpoints.
2. Discover the Joomla login parameters
Use the Network tab in your browser’s Web Developer Tools to identify the parameters.
The "return" parameter is a base64-encoded URL to which the user will be redirected after a successful login. Decoding this base64 string would reveal the actual URL.
3. Identify error messages and protection mechanisms
After one invalid attempt, the following message is returned:
After multiple failed attempts, no protection mechanism came up.
Hydra commands and output
In the first scenario, we used the following Hydra commands to bruteforce the Joomla app:
hydra -l benchmark-user -p bad-password joomla.pentest-ground.com -V https-form-post "/index.php:username=^USER^&passwd=^PASS^&option=com_users&task=user.login&&return=aHR0cHM6Ly9qb29tbGEucGVudGVzdC1ncm91bmQuY29tLw%3D%3D&195456de3e96e3936aa12ea30f4462d4=1:Username and password do not match or you do not have an account yet."hydra -l benchmark-user -p tq6nAhfAhqtwBn7WXWqoaMXWF joomla.pentest-ground.com -V https-form-post "/index.php:username=^USER^&passwd=^PASS^&option=com_users&task=user.login&&return=aHR0cHM6Ly9qb29tbGEucGVudGVzdC1ncm91bmQuY29tLw%3D%3D&195456de3e96e3936aa12ea30f4462d4=1:Username and password do not match or you do not have an account yet."
As visible in the output, Hydra failed to distinguish between invalid and valid credentials, marking both as valid.
For the second scenario, we’ve used the following command:
hydra -L users.txt -P pass.txt joomla.pentest-ground.com https-form-post "/index.php:username=^USER^&passwd=^PASS^&option=com_users&task=user.login&&return=aHR0cHM6Ly9qb29tbGEucGVudGVzdC1ncm91bmQuY29tLw%3D%3D&195456de3e96e3936aa12ea30f4462d4=1:Username and password do not match or you do not have an account yet."
As you can see, Hydra failed to identify any valid credentials, marking all attempts as valid.
Password Auditor commands and results
For the first scenario, we adjusted the following parameters in the interface to conduct a more focused scan:
Ports: Use port from target URL
Services: HTTP
Wordlists: pa-benchmark
Since the pa-benchmark wordlist includes the valid credentials, the tool will make 4 attempts against the target - 3 with invalid credentials and one with valid credentials.
As shown in the screenshots below, Password Auditor successfully identified the valid credentials.
The Password Auditor on Pentest-Tools.com also includes a screenshot of the logged-in session to confirm the provided credentials are valid.
For the second scenario, we modified the wordlist to include 2 users (1 invalid and 1 valid) and 12 passwords (11 invalid and 1 valid).
The Password Auditor identified the valid credentials when testing 2 users and 12 passwords.
Bruteforce commands and settings for Hydra and the Password Auditor
Since every CMS and e-commerce platform handles authentication differently, with varying levels of protection like rate limiting, CAPTCHAs, and account lockouts, you need a tool as flexible and capable as your workflows.
Whether you’re testing a single admin account or running large-scale credential audits, this guide gives you the practical techniques and automation strategies to improve your credential auditing workflow while avoiding unnecessary detection.