4 ms·
You have to be an authenticated user on the admin portal. Doesn't this already come with the expectation of being able to fully control the device?
by solarkraft 7y ago
You have to be an authenticated user on the admin portal. Doesn't this already come with the expectation of being able to fully control the device?
- scaglio 7y agoNot necessarily, web GUI password and user/root ones can be different. From an attacker's point of view: he just needs to crack the Wi-fi (e.g. aircrack-ng), join the LAN an then bruteforce the Pi-Hole webadmin password.
- vgb2k18 7y agoI read further up [1] that Pi-Hole auth is http not https, so if you cracked the WiFi aready, sniffing the webadmin password might yield a quicker return than brute-forcing (depending on strength of password, and owner's login frequency). Assuming the maximum password length of PiHoles is not < 20 chars. [1] https://news.ycombinator.com/item?id=22717938 https://news.ycombinator.com/item?id=22717938