Brute-force Attacks On Admin Panels

Penetration Testing
1

How can i bruteforce admin panel of a website?

2

Always try simple combinations like “admin/admin”. You could also try bruteforcing or phishing.

3

I actually wanted to know the best way to bruteforce panel when phishing is not possible.

4

@D4rkhunt3r please be specific there is no one magic way to brute force every admin login panel, it depends upon the underlying tech it’s using or frameworks in work or maybe a CMS(Like WordPress)

5

Sorry but my question was not specific about any CMS. I wanted to know how can we bruteforce admin panel login. The specific one can be understood easily if the basic is clear. Thank you.

6

hi @D4rkhunt3r so i really recommend you using a tool named “Dirbuster” or “GoBuster” both are the same so those tools can really help you in your progress with penetesting and things it’s like a directory scanner and grabber a relly helpfull tool
availble on kali linux you can excute it from the menu or by typing dirbuster(gui) or just type dirb + your site or you can download it from here : https://www.owasp.org/index.php/Category:OWASP_DirBuster_Project
peace ^^

1 Like
7

brute forcing the credential you just need to resend http request and every request change the value of username,password paramaters so you can use burpsuite or hydra :

brute forcing the admin panel location: do infoGathering about targeted website get the hosted service / CMS [then search about the default admin panel for them]

and try understand this code :

and search about web spidering …

8

@D4rkhunt3r I would suggest to use Thc hydra. It is easy to use and also fast.

9

Thc hydra is buggy af. It is tend to give false positives and one can use Burpsuite or those scripts from GitHub.