Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Problem: Hydra keeps giving me incorrect passwords every time. I'm using brute-force via Hydra to guess the correct password on a certain website.

First of all I used BurpSuite to intercept the page request:

POST /abcdefg/ HTTP/1.1
Host: localhost:2000 
User-Agent: Mozilla/5.0 (X11; Linux i686; rv:22.0) Gecko/20100101 Firefox/22.0 Iceweasel/22.0 
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 
Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Referer: http://localhost:2000/abcdefg/ Connection: keep-alive Content-Type: application/x-www-form-urlencoded Content-Length: 23 

usr=admin&pass=password

I am using these parameters for the command-line:

hydra -f -v -V 127.0.0.1 -s 2000 http-post-form -l admin -P /documents/pass.txt "/abcdefg/:pass=^PASS^:incorrect password"
  1. Host = 127.0.0.1 ( I know I can also try with localhost)
  2. Port = 2000 (My local computer is listening for HTTP at port 2000)
  3. Method = http-post-form
  4. URL = /abcdefg/
  5. Form parameters = pass=^PASS^
  6. Failure response = incorrect password. When I click submit, the page reloads with the same URL, but with only the text 'incorrect password' on screen.
  7. User = admin
  8. Password file = pass.txt

The page source of the login page:

<html>
<head>
 <title>Login</title>
</head>
        <form action="./" method="post">
        username <input type="text" name="usr"></br>
        password <input type="password" name="pass"></br>
        <input type="submit" value="Submit">
        </form>
</html>

The page source of the 'incorrect password' page:

<html>
<head>
 <title>Login</title>
</head>

<br>incorrect password

Please do take a look at all the parameters to make sure I am using the right commands. I have also taken a look at this question: Why does Hydra return 16 valid passwords when none are valid? which suggests to check the page cookies, but the webpage I'm trying to brute force into does not use cookies, so I think that is irrelevant?

I am just starting off penetration testing so it would be cool if you guys can help me out, I might be missing obvious details :) Thanks in advance!

share|improve this question

1 Answer 1

up vote 2 down vote accepted

Shouldn't

"/abcdefg/:pass=^PASS^:incorrect password" be set to

"/:usr=^USER^&pass=^PASS^:incorrect password"

to match your form action as <form action="./" and username input as <input type="text" name="usr">?

share|improve this answer
    
Oh, I thought it's okay to leave that one out since I want Hydra to only test the password field, but thinking again, it makes sense to include the use field. Isn't the format supposed to be "URL_of_the_page:input fields:failure message"? I used "/abcdefg/:usr=^USER^&pass=^PASS^:incorrect password" This seems to do the trick! Thanks! –  Salcybercat Nov 25 '13 at 14:12

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.