Level 12 | Dictionary Attack

Your task is to crack the password of the user called admin. Use whatever tool you like but we would recommend entering Google and searching for filetype:lst password in order to perform a dictionary attack.

Target:

• http://ctf.infosecinstitute.com/ctf2/exercises/ex12.php

Tools:

• Firefox
• BurpSuite
• Hydra

Using BurpSuite

Intercept the request

Send the request to Intruder then specify the password field to be intruded.

Add password list to burpsuite then launche the attack

Checking the changed page size and it was on password princess

Now let's to login with

Username: admin
Password: princess

Using Hydra

hydra -l admin -P /home/pentest/wordlists/passwords.lst ctf.infosecinstitute.com http-post-form "/ctf2/exercises/ex12.php:username=admin&password=princess&logIn=Loginusername=admin&password=^PASS^&logIn=Login:Incorrect username or password combination"

Done!