Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I've been trying to use hydra (educational way) but with no success. The site method is http-post but performed by ajax (should it be a problem? I think not). After execute the command I got an output of passwords and username that allegedly valid. I saw that some people have asked about the reason for hydra giving wrong passwords and usernames and the answer was that the command should include the PHPSESSID. So I've been trying to use PHPSESSID but nothing changes.

the command:

hydra -L id.txt -P id.txt -s 80 -f 62.239.61.241 http-post-form "/Login/ajax/user-login.php:data=username=^USER^&password=^Pass^&remember=off&returnpath=:Fail :H=Cookie: security=low;PHPSESSID=9adriqaprd8f1qgot3ia1k3"

Any suggestions for the wrong passwords?

share|improve this question
    
You need more information about the page you're attacking. Try a manual test with curl or so, and see if the page actually sends "Fail " (with space) back to you, which is what you are searching for. –  m1ke Feb 20 at 12:41
    
Are you trying that on Damn Vulnerable Web Application (DVWA) ? –  ack__ Feb 21 at 12:41
    
First of all, thanks for reply. -It doesn't send fail at all. -No, I'm using kali-linux. –  user40118 Feb 21 at 15:17

1 Answer 1

The way that Hydra determines if an attempt was successful or not is by comparing strings found in successful and unsuccessful return pages.

in your scenario i am assuming that the application is returning Fail if the attempt is not successful and something else if it is. if the page is blank in both cases that means all the attempts will be considered successful.

you should find a unique string in the return page (or page source) and put it after the :

more information here

http://insidetrust.blogspot.com/2011/08/using-hydra-to-dictionary-attack-web.html

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.