Reply: Hydra syntax help

It blacklisted the IP. Just use another device and change the blacklist to enable it again. Brute force is being protected. I would try maybe telnet brute force if enabled.

Hej!

I'd LOVE to try out your changes to the code, however it seems it has some nasty kind of protection: I entered like 20 bullshit combinations and now i can't connect to 192.168.5.1 anymore. My phone can however. I tried using a mobile wi-fi hotspot but it wouldn't work either. I think I'll install Cygwin on my laptop when I have the time..

Well, the way to test is to try a few times to to get into it with the wrong creds. That will let you know if there is BF protection. As far as the command go, from what information I have gathered from you I think you need to use this syntax.

hydra 192.168.5.1 https-form post "/index.php:usernamefld^USER^&passwordfld=^PASS^:Username or Password incorrect:H=Cookie: security=low; PHPSESSID=e39428acfd434a5add602282ed6928ff"-S -v -f -l /path/to/logins -p /path/to/passwords -o /use/instead/of/STDOUT

I am not 100% sure what you mean with 'where' it's posting. I've added a screencap just to be sure Do you mean the server? (lighttpd/1.4.35)
Also I have no idea if it's bruteforce proof tbh, I know it's possible to put some anti-bruteforce protection on it though.

What you can do is open up developer tools on your browser and then go to network tab. Attempt a login and catch where its posting. Also, I'm sure you have tried but... Does your router have brute force protection?

Hey GH05T,
I'll be honest; I've never seen a pop-up based login for routers/modems in the Netherlands.. This router specifically uses pfSense, an open source firewall-router software thingie.
I started hydra with a syntax like you said (ping, name, password list, port followed by http-get / ) however that's for a GET based login, and I'm 90% sure mine's a POST based one. This makes things more difficult I think.. This website helped me abit to get on the right track but you need to know quite some variables it seems.