Passwords
Test exposed phpMyAdmin panels against a password list
Password wordlist attacks against phpMyAdmin login forms.
overview
What phpmyadmin-auth-bruteforce does
phpmyadmin-auth-bruteforce submits passwords from a wordlist against one phpMyAdmin login form. Set -url to the panel, -user to the account (often root), and -dict to the password file.
Use it when discovery already found an exposed panel. Each guess is a full form round-trip, so start with a short known-bad list before a large general wordlist.
hydra can hit the same panel via http-post-form once you supply path, POST body, and failure string. This tool handles phpMyAdmin session handling with less setup. Results land in FILE and FOLDER outputs.
source github.com/safflower/phpmyadmin-authentication-bruteforce
use cases
Where phpmyadmin-auth-bruteforce fits
Test an exposed phpMyAdmin panel
Run a password list against a discovered phpMyAdmin login to confirm whether default or weak credentials still guard the database front end.
Validate database-tier credential hygiene
Check the root or admin account of a phpMyAdmin install against a known-bad password list so a weak credential is caught before an attacker finds it.
Follow a panel-discovery stage
Feed URLs of exposed phpMyAdmin instances from a content-discovery or probing stage into this tool so the brute force runs only against real panels.
reference
phpmyadmin-auth-bruteforce inputs and flags
| Name | Type | Flag | Description |
|---|---|---|---|
| url | STRING | -url | Target phpMyAdmin URL to attack. |
| username | STRING | -user | Username to brute-force passwords against (often root). |
| wordlist | FILE | -dict | Wordlist of passwords to try against the login. |
Showing key inputs. phpmyadmin-auth-bruteforce exposes 3 inputs in total.
example
Run phpmyadmin-auth-bruteforce
# brute-force the phpMyAdmin login for the root userpython3 main.py -url https://example.com/phpmyadmin/ -user root -dict /usr/share/wordlists/rockyou.txt[*] Target: https://example.com/phpmyadmin/[*] Username: root[*] Passwords loaded: 14344391[-] root : 123456[-] root : password[-] root : letmein[+] root : Db-Adm1n! -> login accepted[*] Valid credentials: 1[*] Elapsed: 00:03:47guidance
Choosing phpmyadmin-auth-bruteforce
Reach for this after a content-discovery or probing stage finds phpMyAdmin URLs. It tests one login form and one -user at a time. For multi-protocol network logins, use hydra instead.
hydra
General network login cracker across many protocols. This tool is purpose-built for the phpMyAdmin form.
pydictor
Builds the candidate wordlist rather than running the attack. Generate a list with pydictor, then feed it here via -dict.
sqlmap
Attacks the database through SQL injection instead of the login form. Different entry point on the same data tier.
faq
phpmyadmin-auth-bruteforce questions
Run phpmyadmin-auth-bruteforce yourself
A panel URL and a password list feed phpmyadmin-auth-bruteforce, which tries each password against the login and writes any valid credential as output.
Facts on this page come from the live Trickest tool library.