Hi,
We have a requirement from our security team to test the brute force attack scenario against user name and password of our application using THC Hydra password cracking tool
We are using https ( default port 443) . Application url is of the form : https://hostname.com/en-US/app/appname.
Basically hydra tool takes a list of users and passwords from the input file and validate it against the application. We will also pass null user and passwords and see the behavior.
Issue is I am not able to pass (use) the right url of the application containing user/password, hence the hydra tool always results in http "401" response even when I provide correct user name and password.
To simply and debug the issue, I used the Chrome REST Client(Postman,PostIT) and I get the same "http 401" response. Following url was tried with REST Client tool. When we access the application, splunk prompts for user/password. Submitting the form uses the below url:
**1) URL : https://hostname.com/en-US/account/login**
Method: POST
Params in body :username="xyz" and password="xyz"
Response:Http 401
My questions :
a) Does Splunk require anything to successfully authorize the url:https://hostname.com/en-US/account/login? Please let me know.
b) Any other suggestion to run this test against our application url with user name and password.
Thanks.
↧