How to bruteforce development, CI/CD, and other apps with Hydra and the Password Auditor
Compromising development and CI/CD tools can give attackers access to source code repositories, automation pipelines, and deployment systems, making them high-value targets.
This guide provides real-world testing methodologies for Bitbucket, GitLab CE, Jenkins, JetBrains TeamCity, and more, helping you discover login endpoints, analyze authentication mechanisms, and test credential security. By applying these techniques, you can uncover authentication weaknesses before attackers do, ensuring a stronger security posture for the systems you audit.
How to check JetBrains TeamCity for weak credentials
Deployment method: Vulhub docker-compose
1. Find the web app login endpoint for JetBrains TeamCity
The default admin login page for JetBrains TeamCity is typically located on the /login.html endpoint on port 8111.
2. Discover the login parameters for JetBrains TeamCity
Use the Network tab in Web Developer Tools to identify the parameters.
In JetBrains TeamCity, the login page uses the publicKey and encryptedPassword parameters as part of the authentication process to enhance security.
Here's a brief explanation of each concept:
publicKey: This is the public portion of a key pair (public/private key) used for RSA encryption. JetBrains TeamCity provides this public key to the client (browser) during the login process. The public key is used to encrypt sensitive information, specifically the password, before it gets sent to the server. This helps protect the password during transmission, even if the data is intercepted.
encryptedPassword: This is the user's password, encrypted using the RSA public key provided by TeamCity. When a user enters their password, it is encrypted client-side using JavaScript with the public key. The resulting encryptedPassword value is then sent to the server instead of the plain text password. On the server side, TeamCity uses the corresponding private key to decrypt the password and authenticate the user.
This mechanism prevents the plain text password from being exposed during transmission, adding an extra layer of security against potential interception or eavesdropping attacks.
3. Identify error messages and protection mechanisms
After one invalid attempt, JetBrains TeamCity returns the following message:
After 5 failed login attempts, the user gets locked out for 1 minute.
Hydra commands and output
Since Hydra can’t use the Javascript that encrypts the password using the public key, we considered that the scenarios cannot be tested.
Password Auditor commands and results
For the first scenario, these are the parameters we adjusted to perform a more focused scan:
Target: http://teamcity.pentest-ground.com:8111/login.html
Ports: Use port from target URL
Services: HTTP
Wordlists: pa-benchmark
The pa-benchmark wordlist includes valid credentials, so the process involves making four attempts to the target: 3 with invalid credentials and 1 with valid credentials.
As shown in the screenshots below, the Password Auditor on Pentest-Tools.com successfully identified the valid credentials.
The Password Auditor also provides a screenshot of the logged-in session to verify the validity of the provided credentials.
For the second scenario, we adjusted the wordlist to contain 2 users (1 invalid and 1 valid) and 13 passwords (12 invalid and 1 valid).
JetBrains TeamCity temporarily locks the account/source IP and the Password Auditor can’t identify the valid credentials.
Bruteforce commands and settings for Hydra and the Password Auditor
Since authentication security varies across different platforms - some using CAPTCHAs, CSRF tokens, or IP-based rate limiting - choosing the right testing approach is essential. These detailed Hydra commands for manual bruteforcing are ready to use, along with steps that demonstrate how the Password Auditor automates credential testing for more efficient, reliable assessments.
You’ll see how Hydra interacts with authentication defenses and how the Password Auditor captures screenshots and proof of valid credentials to streamline your security audits.