> For the complete documentation index, see [llms.txt](https://d3ndr1t30x.gitbook.io/breaking-things-a-junior-pentesters-guide/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://d3ndr1t30x.gitbook.io/breaking-things-a-junior-pentesters-guide/brute-forcing-wordpress-login-pages.md).
# Brute forcing WordPress login pages
This was taken from the MrRobot CTF room on TryHackMe
intercepting the post request to the WP login with burp
## Using Hydra to brute force the login form
```
hydra -V -L /root/thm/mrrobot/fsocity.dic -p 123 10.10.25.63 http-post-form '/wp-login.php:log=^USER^&pwd=^PASS^&wp-submit=Log+In:F=Invalid username'
```
Here's a breakdown of the command:
1. `hydra` is the name of the tool
2. `-V` is an option that enables verbose output. This means that hydra will output detailed information about its progress and any errors that occur during the attack.
3. `-L /root/thm/mrrobot/wordlist.dict` is an option that specifies the path to a file containing a list of usernames to use during the brute force attack. In this case, the file is located at `/root/thm/mrrobot/wordlist.dict`.
4. `-p 123` is an option that specifies the password to use during the brute force attack. In this case, the password is set to `123`.
5. `10.10.25.63` is the IP address of the target system that hydra will attempt to log into.
6. `http-post-form` is a module that tells hydra to use the HTTP POST method to send login requests to the target system.
7. `'wp-login.php:log=^USER^&pwd=^PASS^&wp-submit=Log+In:F=Invalid username'` is the URL that hydra will use to send login requests to the target system. This URL specifies the login form fields and their corresponding values that hydra will attempt to brute force. Specifically, it tells hydra to send a POST request to `wp-login.php` with the `log` field set to the current username, the `pwd` field set to the current password, and the `wp-submit` field set to `Log+In`. The `F=Invalid username` part tells hydra to check the response from the server for the string `Invalid username`, which indicates that the login attempt failed.
Brute forcing the login page with WPScan
Brute forcing the password with WPScan. Adjust the ip and directories to suit your unique target
