How to bruteforce IT and server management apps with Hydra and the Password Auditor
Bruteforcing login endpoints is essential for assessing the security of IT and server management applications. Gaining access to these web apps can expose critical administrative controls, server configurations, database access, email accounts, and other sensitive assets that attackers target.
This guide provides real-world testing methodologies for cPanel, Plesk, Webmin, phpMyAdmin, and more, helping you discover login parameters, analyze authentication mechanisms, and test login security measures. By applying these techniques, you can pinpoint authentication weaknesses before malicious attackers do, ensuring a stronger security posture for the systems you audit.
How to check Webmin for weak credentials
Deployment method: Vultr marketplace
1. Find the web app login endpoint for Webmin
You can customarily find the Webmin login form on the / endpoint on port 10000.
2. Discover the Webmin login parameters
Use the Network tab in Web Developer Tools to identify the parameters.
3. Identify error messages and protection mechanisms
After one invalid attempt, Webmin returns the following message:
After more than 5 invalid tries, the IP got blocked.
Hydra commands and output
In the first 1 set of valid and 1 set of invalid credentials scenario, we used the following Hydra commands:
hydra -s 10000 -l root -p bad-password webmin.pentest-ground.com https-post-form "/:user=^USER^&pass=^PASS^:Login failed. Please try again." -Vhydra -s 10000 -l root -p iH6$6KEXNKpqUSHG webmin.pentest-ground.com https-post-form "/:user=^USER^&pass=^PASS^:Login failed. Please try again." -V
As you can see from the output, Hydra marked both tries as valid credentials.
We did not test the second scenario since the first one did not work.
Password Auditor commands and results
For the first scenario, these are the parameters we adjusted to perform a more focused scan:
Ports: Use port from target URL
Services: HTTP
Wordlists: pa-benchmark
The pa-benchmark wordlist includes valid credentials, so the process involves making four attempts to the target: 3 with invalid credentials and 1 with valid credentials.
The screenshots below show that the Pentest-Tools.com Password Auditor successfully identified the valid credentials.
The Password Auditor also provides a screenshot of the logged-in session to verify the validity of the provided credentials.
For the second scenario, the wordlist we used included 2 users (1 invalid and 1 valid) and 12 passwords (11 invalid and 1 valid).
Because Webmin activated its protection mechanism and blocked the scanner's source IP address, the Password Auditor was unable to identify the valid credentials. However, it reported the block as an informational finding.
Bruteforce commands and settings for Hydra and the Password Auditor
Learn when to use Hydra for brute-force attacks and when the Password Auditor’s automation, screenshot capture, and proof-based reporting provide a better alternative for correctly identifying login credentials with greater speed and accuracy.
By testing these login security measures, you can identify risks that could lead to unauthorized server access, control panel takeovers, or database breaches, helping organizations stay ahead of real-world threats.