Introduction
In this lab, you will learn how attackers compromise weak web authentication systems. You will analyze standard HTTP POST login requests and configure the Hydra brute-force tool to perform automated dictionary attacks against a web portal's login form to recover valid credentials.
Brute-force attacks involve systematically submitting many passwords or passphrases with the hope of eventually guessing correctly. When targeting web applications, attackers often focus on login forms that use the HTTP POST method to transmit user credentials. Understanding how these attacks work is crucial for securing web applications and implementing proper rate limiting and account lockout mechanisms.
This is fundamentally an authentication economics problem. If the application lets attackers make many guesses cheaply, weak or reused credentials become realistic to recover.
Analyze the Login Request Parameters
In this step, you will analyze the target web application to understand how it processes login requests. Before launching a brute-force attack, you must identify the target URL, the HTTP method used, the names of the input fields, and the message returned upon a failed login attempt.
That reconnaissance step matters because tools like Hydra are only as good as the request template you give them. If you misunderstand the form, the attack logic is wrong from the start.
A local web server has been started for you on port 8080. First, let's view the HTML source code of the login page to identify the form parameters. You can use the curl command to fetch the webpage content.
curl -s http://127.0.0.1:8080/
The output will display a simple HTML form. Notice the action="/login" attribute, which tells us where the form data is sent. The method="POST" attribute indicates that the data is sent using an HTTP POST request. Finally, observe the name attributes of the input fields: username and password.
Next, you need to simulate a failed login attempt to see how the server responds. This is a critical step because brute-force tools need to know what a "failure" looks like so they can identify a "success" when the failure message is absent.
Use curl to send a POST request with dummy credentials. The -X POST flag specifies the HTTP method, and the -d flag allows you to send the form data.
curl -X POST -d "username=testuser&password=wrongpass" http://127.0.0.1:8080/login
You should see the following output:
Invalid credentials. Please try again.
This specific string, Invalid credentials, is the failure message. You will use this exact phrase later to configure the brute-force tool.
Select Target Wordlists
In this step, you will prepare the dictionaries (wordlists) that will be used for the brute-force attack. A dictionary attack relies on a predefined list of potential usernames and passwords.
Dictionary attacks are faster than blind exhaustive search because they exploit human predictability. People do not choose passwords uniformly at random.
Instead of trying every possible combination of characters, attackers use wordlists containing common usernames (like admin, root, user) and frequently used passwords (like 123456, password, qwerty).
You will create two simple text files in your current working directory (~/project). The first file will contain a list of potential usernames. Use the echo command to write names into a file called users.txt.
echo "root" > users.txt
echo "admin" >> users.txt
echo "test" >> users.txt
The > operator creates the file and writes the first line, while the >> operator appends subsequent lines to the existing file.
Next, create a file called passwords.txt containing a list of potential passwords.
echo "password123" > passwords.txt
echo "admin123" >> passwords.txt
echo "secret123" >> passwords.txt
echo "123456" >> passwords.txt
You can verify the contents of your newly created wordlists using the cat command.
cat users.txt
cat passwords.txt
In a real-world scenario, penetration testers use massive, publicly available wordlists like rockyou.txt, which contains millions of compromised passwords. For this educational lab, these small custom wordlists will suffice.
Configure Hydra for HTTP POST Form
In this step, you will learn how to structure the command for Hydra, a powerful network logon cracker. Hydra supports numerous protocols, including HTTP, FTP, SSH, and more.
To attack a web login form, Hydra uses a specific module called http-post-form. This module requires a carefully formatted string to understand how to interact with the target web application.
The syntax for the http-post-form module looks like this: "<path>:<form parameters>:<failure string>"
Let's break down how this applies to the information you gathered in Step 1. First is the path, which is the URL where the form is submitted; in our case, it is /login. Next are the form parameters, representing the data sent in the POST request. You found the fields were username and password. Hydra uses special placeholders ^USER^ and ^PASS^ to inject the words from your wordlists, so the parameter string becomes username=^USER^&password=^PASS^. Finally, the failure string is the text that appears on the page when a login fails, which you identified as Invalid credentials.
Combining these three parts with colons, the module configuration string becomes: "/login:username=^USER^&password=^PASS^:Invalid credentials"
Before running the actual attack, you can explore Hydra's built-in help documentation for the http-post-form module to understand its capabilities better. Run the following command to view the module-specific help:
hydra -U http-post-form
This command outputs detailed instructions and examples on how to format the module string, which is an excellent reference when you encounter more complex login forms in the future.
Execute the Brute-Force Attack
In this step, you will combine everything you have learned to execute the automated dictionary attack against the local web server.
You will use the hydra command with several flags:
-L users.txt: Specifies the file containing the list of usernames.-P passwords.txt: Specifies the file containing the list of passwords.-s 8080: Specifies the target port.127.0.0.1: The IP address of the target server.http-post-form: The protocol module to use."/login:username=^USER^&password=^PASS^:Invalid credentials": The module configuration string you built in the previous step.
Execute the following command in your terminal to start the brute-force attack:
hydra -L users.txt -P passwords.txt -s 8080 127.0.0.1 http-post-form "/login:username=^USER^&password=^PASS^:Invalid credentials"
Hydra will begin testing every combination of usernames and passwords from your wordlists. Because the wordlists are small and the server is local, the attack will finish very quickly.
You should see output similar to the following:
Hydra v9.2 (c) 2021 by van Hauser/THC - Please do not use in military or secret service organizations, or for illegal purposes.
Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2026-10-25 10:00:00
[DATA] max 12 tasks per 1 server, overall 12 tasks, 12 login tries (l:3/p:4), ~1 tries per task
[DATA] attacking http-post-form://127.0.0.1:8080/login:username=^USER^&password=^PASS^:Invalid credentials
[8080][http-post-form] host: 127.0.0.1 login: admin password: secret123
1 of 1 target successfully completed, 1 valid password found
Hydra (https://github.com/vanhauser-thc/thc-hydra) finished at 2026-10-25 10:00:01
Notice the line highlighted in green (or explicitly stating success): [8080][http-post-form] host: 127.0.0.1 login: admin password: secret123. Hydra successfully identified that the combination of the username admin and the password secret123 did not return the "Invalid credentials" string, meaning the login was successful.
Summary
In this lab, you successfully learned how to analyze and attack a weak web authentication system. You started by inspecting an HTTP POST login form to identify the target path, input parameters, and failure messages. You then created custom wordlists for a dictionary attack. Finally, you configured and executed the Hydra brute-force tool to automate the login attempts and successfully recover the valid credentials.
Understanding these techniques highlights the importance of implementing strong security measures, such as account lockouts, CAPTCHAs, and multi-factor authentication (MFA), to protect web applications against automated brute-force attacks.
