If I didn’t know it offhand, it couldīe found rather easily by scanning the network with a tool such as nmap. Since this is on my network, I already know the IP address of this device. Sure, basic auth should be totally fine to protect this remotely controllable window into my home. Manufacturers? If I click on the Server Push mode Login button, I am presented with a basic auth login form. If you’ve ever used an IP camera or similar networked device, the above image is probably rather familiar.Ī basic form and buttons that look like they came straight from geocities, what more could we want from hardware If you have username list you’d like to use, then go for it. Optional Username List - A list of usernames to testįor this demo, I’m not using a username list and am just going by the commonly used default username admin There are more conclusive lists out there (hint google ‘rockyou wordlist’), but these should be enough to get you started. I’ve created wordlists using data from ĭisclaimer: People commonly use passwords with NSFW language.

Debian - sudo apt-get install hydra hydra-gtk.

OSX Install via Homebrew - brew install hydra.

Comes preinstalled with security distros of Linux (e.g.

Step 1 - Gather Tools THC-Hydra - Our dictionary attack tool of choice I’m going to demonstrate just how easy it is to break into such a device by running an attack on my home webcam using Hydra. To complicate matters, these devices don’t have any lockout mechanisms in place to prevent password guessing attacks like dictionary or brute-force attacks.

However it is used quite frequently in our home network devices like routers and webcams. HTTP Basic Authentication is a known weak authentication system and isn’t often used in web apps anymore.

John the ripper github