How to bruteforce monitoring and security apps with Hydra and the Password Auditor
Every CMS and e-commerce platform handles authentication differently, with varying levels of protection like rate limiting, CAPTCHAs, and account lockouts. This guide provides real-world testing methodologies for WordPress, Drupal, Joomla, PrestaShop, and Magento, helping you correctly identify weak login endpoints, analyze error messages, and work around security mechanisms for efficient pentests and security assessments.
You’ll find detailed Hydra commands for precise, high-efficiency bruteforcing, along with insights on using our Password Auditor to automate credential testing. This comparison makes it easier to choose which tool can help you brute-forcing faster and more effectively by capturing screenshots of logged-in sessions and generating detailed proof of valid credentials.
How to check F5 BIG-IP for weak credentials
Deployment method: ISO image with v15.1.0
1. Find the web app login endpoint for F5 BIG-IP
The default admin login page for F5 BIG-IP is typically located on the /tmui/login.jsp endpoint on port 8443 or 443.
2. Discover the login parameters for F5 BIG-IP
Use the Network tab in Web Developer Tools to identify the parameters.
3. Identify error messages and protection mechanisms
After one invalid attempt, F5 BIG-IP returns the following message:
Hydra commands and output
In the first 1 set of valid and 1 set of invalid credentials scenario, we used the following Hydra commands:
hydra -s 8443 -l admin -p bad-password big-ip.pentest-ground.com https-post-form "/tmui/logmein.html?:username=^USER^&passwd=^PASS^:Login failed" -V -IHydra suggests using the https-get module, since the application returned 401 HTTP error code.
hydra -s 8443 -l admin -p bad-password big-ip.pentest-ground.com https-get "/tmui/logmein.html?username=^USER^&passwd=^PASS^:F=Login failed" -V -Ihydra -s 8443 -l admin -p tq6nAhfAhqtwBn7WXWqoaMXWF big-ip.pentest-ground.com https-get "/tmui/logmein.html?username=^USER^&passwd=^PASS^:F=Login failed" -V -I
Since the first scenario didn't work, we did not proceed with testing the second one.
Password Auditor commands and results
For the first scenario, these are the parameters we adjusted to perform a more focused scan:
Target: https://big-ip.pentest-ground.com:8443/tmui/login.jsp
Ports: Use port from target URL
Services: HTTP
Wordlists: pa-benchmark
The pa-benchmark wordlist includes valid credentials, so the process involves making four attempts to the target: 3 with invalid credentials and 1 with valid credentials.
As shown in the screenshots below, Password Auditor successfully identified the valid credentials.
The Password Auditor also provides a screenshot of the logged-in session to verify the validity of the provided credentials.
For the second scenario, we only adjusted the wordlist to include 2 users (1 invalid and 1 valid) and 13 passwords (12 invalid and 1 valid).
In the second scenario, the Password Auditor on Pentest-Tools.com identified the valid credentials.
Bruteforce commands and settings for Hydra and the Password Auditor
Whether you’re testing a single admin account or running large-scale credential audits, this guide gives you the practical techniques and automation strategies to improve your credential auditing workflow while avoiding unnecessary detection.