The following options must be specified:
- Target URL
- Number of requests to send (per guess)
- Message that displays on the page when there is a failed login
- The username to use when logging in
- The characterset to use
- The variable names of the input fields in the HTML form for the username and password field (POST request username and password fields, defaults to 'username' and 'password')
Additionally, a known correct password can be specified (--poc-password). The timing attack will run until each character matches the known password. If a character does not match, the test will restart from the first character.
To determine the correct parameter names for the request as well as the error message from invalid credentials, view the source of the page you are targeting (and then view the source of the page that displays the error message).
How to Run
Download tool : https://goo.gl/paZqRk
Posts
