mutillidae brute force login

Brute Force Web Login using Hydra

OS used: Kali Linux
Tool Used: hydra/ burp suite
web app: mutillidae

here is the command used in full;
hydra -l admin -P /root/Desktop/work/mutillidae/mutilldae-passwords 192.168.0.9  http-post-form "/mutillidae/index.php?page=login.php:username=^USER^&password=^PASS^&login-php-submit-button=Login:Not Logged In"


lets break it down

hydra > this is the name of the brute force program
-l admin > this tells the program to check the username admin (this was gained via enumeration earlier)
 -P /root/Desktop/work/mutillidae/mutilldae-passwords >this is the path to the password file used
192.168.0.9 > this is the host address (ip) of the server 
http-post-form > this is the type of form we are attacking
"/mutillidae/index.php?page=login.php:username=^USER^&password=^PASS^&login-php-submit-button=Login:Not Logged In"

 "/mutillidae/index.php?page=login.php > this is the parameter to the login page the " is appended to the beginning

to work out the remainder of the command consider the following

 this was taken from burp suite and is the result of a POST request to the server in an attempt to login, we pass these paramemters in part to hydra to complete the command prior to attacking the login page. Hence the command continues with;
:username=^USER^&password=^PASS^&login-php-submit-button=Login
but there is still one more piece of info we need which is  
:Not Logged In"
the " is appended to the end the Not Logged In is the result of a user not been logged and is what is presented when you visit the log in page without logging in as shown below

remember these parameters will differ depending on the application used
the command

hydra -l admin -P /root/Desktop/work/mutillidae/mutilldae-passwords 192.168.0.9  http-post-form "/mutillidae/index.php?page=login.php:username=^USER^&password=^PASS^&login-php-submit-button=Login:Not Logged In"

is now complete and we begin our attack

Brute Force Login Using Burp Suite Intruder

Brute Force Login Using Burp Suite Intruder

tools: burp suite & iceweasel
web app: mutillidae 

Here I use burp suite intruder to brute force the login of the admin user (remember we enumerated this in an earlier video)

here is the full video of how to brute force a login using burp suite

In short

• ensure proxy is working 
• capture a known bad request 
• right click  on request and sent to burp intruder
• set payload position
• load payloads
• attack

Its worth noting the following findings; in short; (in mutillidae)

• where there is a response code of 302 a successful password has been found 
• the length differs when compared to non successful logins, for example in the video 

successful logins have a length of 48763 (in mutillidae via burp suite)
unsuccessful logins have a length of 48669 (in mutillidae via burp suite)