> For the complete documentation index, see [llms.txt](https://106-sam.gitbook.io/ejptv2-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://106-sam.gitbook.io/ejptv2-notes/introduction-to-the-web-and-http-protocol/attacking-http-login-form-and-basic-auth.md).

# Attacking HTTP Login Form & Basic Auth

### Attacking HTTP Login Form with Hydra

```
cat users
```

```
cat /root/Desktop/wordlists/100-common-passwords.txt > passwords
```

```
echo "bug" >> passwords
```

```
hydra -L users -P passwords <IP> http-post-form "/login.php:login=^USER^&password=^PASS^&security_level=0&form=submit:Invalid credentials or user not activated!"
```

* intercept it with the burpsuite&#x20;

{% embed url="<https://github.com/vanhauser-thc/thc-hydra>" %}

***

### Attacking Basic Auth with Burp Suite.

* Open Burp Suite&#x20;
* browse to website http\://\<IP>/basic
* Its prompts us for username and password.
* capture the request after filling the prompt
* Send it to the intruder
* set position to test:test in Authorization header

Intruder > Payloads >\[Payload Options Simple list] Load password (common-password.txt)

Intruder > Payloads > \[Payload Processing] > Add > Add a prefix (admin) > Add Encode (Base64)

Start Attack

* we get 301 > send to decoder Base64

***

### Attacking HTTP Login Form with ZAProxy

* Open ZAProxy -> Manual Explore
* Type the url and launch browser
* capture this so provide invalid credentials
* After selecting go to the request tab
* Right click > FUZZ&#x20;
* highlight \<username> and add "admin, bee"
* highlight \<password> and add "admin, password,adminpasswd,bug,bee"
* start the fuzzer

302

{% embed url="<https://www.zaproxy.org/>" %}