How to bruteforce CMSs and e-commerce apps with Hydra and the Password Auditor
This guide provides real-world testing methodologies for WordPress, Drupal, Joomla, PrestaShop, and Magento, helping you correctly identify weak login endpoints, analyze error messages, and work around security mechanisms for efficient pentests and security assessments.
You’ll find detailed Hydra commands for precise, high-efficiency bruteforcing, along with insights on using our Password Auditor to automate credential testing. This comparison makes it easier to choose which tool can help you brute-forcing faster and more effectively by capturing screenshots of logged-in sessions and generating detailed proof of valid credentials.
How to check PrestaShop for weak credentials
Deployment method: Vultr marketplace
1. Find the web app login endpoint for PrestaShop
The default admin login page for PrestaShop is typically located at /admin. However, during installation, PrestaShop prompts you to rename the /admin directory for security reasons.
The renamed endpoint would look something like /admin123, where admin123 is a randomly generated or manually chosen name.
Vultr has created the /admin_area/ link as a convenient static URL.
2. Discover the PrestaShop login parameters
Use the Network tab in Web Developer Tools to identify the parameters.
In PrestaShop, the redirect parameter often contains a CSRF (Cross-Site Request Forgery) token. This is used to ensure the security of redirect actions by verifying they are legitimate and come from a trusted source.
3. Identify error messages and protection mechanisms
After one invalid attempt, PrestaShop returns the following message:
Hydra commands and output
In the first 1 set of valid and 1 set of invalid credentials scenario, we used the following Hydra commands:
hydra -l "root@pentest-ground.com" -p bad-password prestashop.pentest-ground.com https-post-form "/admin_area/index.php:ajax=1&token=&controller=AdminLogin&submitLogin=1&passwd=^PASS^&email=^USER^&redirect=https%3A%2F%2F108.61.179.203%2Fadmin_area%2F%26token%3Dfd2e9ec78690e5340b24d24565fa0373&stay_logged_in=1:Invalid password." -Vhydra -l "root@pentest-ground.com" -p iY5Na7ZIa3WPgrh3zrVgYdQmF6rnNCtb prestashop.pentest-ground.com https-post-form "/admin_area/index.php:ajax=1&token=&controller=AdminLogin&submitLogin=1&passwd=^PASS^&email=^USER^&redirect=https%3A%2F%2F108.61.179.203%2Fadmin_area%2F%26token%3Dfd2e9ec78690e5340b24d24565fa0373&stay_logged_in=1:Invalid password." -V
PrestaShop uses the redirect parameter as a CSRF token, which changes with each request. Since Hydra requires this parameter to be configured as static, it cannot generate these tokens. Consequently, Hydra marked both attempts as valid credentials.
Since the first scenario didn't work, we did not proceed with testing the second one.
Password Auditor commands and results
For the first scenario, these are the parameters we adjusted to perform a more focused scan:
Target: https://prestashop.pentest-ground.com/admin_area/index.php
Ports: Use port from target URL
Services: HTTP
Wordlists: pa-benchmark
The pa-benchmark wordlist includes valid credentials, so the process involves making four attempts to the target: 3 with invalid credentials and 1 with valid credentials.
The screenshots below show that the Pentest-Tools.com Password Auditor successfully identified the valid credentials.
The Pentest-Tools.com Password Auditor also includes a screenshot of the logged-in session to confirm the provided credentials are valid.
For the second scenario, we only changed the wordlist to include 2 users (1 invalid and 1 valid) and 13 passwords (12 invalid and 1 valid).
In the second scenario, the Password Auditor on Pentest-Tools.com identified the valid credentials.
Bruteforce commands and settings for Hydra and the Password Auditor
Since every CMS and e-commerce platform handles authentication differently, with varying levels of protection like rate limiting, CAPTCHAs, and account lockouts, you need a tool as flexible and capable as your workflows.
Whether you’re testing a single admin account or running large-scale credential audits, this guide gives you the practical techniques and automation strategies to improve your credential auditing workflow while avoiding unnecessary detection.