Hydra: Brute force an http form, all arguments are supplied but the login error has other string formats and is too big

Question

I am using Hydra to brute force a login http form (Method: post), but I'm getting false positives (passwords that aren't valid)

I believe I know the reason, I just don't know how to handle it: The failure of the request produces the following failed message containing strings as "é":

(the error is only printed on the screen, nothing in the url.) "Desolé: Vos détails de connexion n'ont pas été réconnus, réessayer." (this is the error you get when submititng invalide credentials.

So I have read that the string lenght and format affects how Hydra responds. This is the how command I execute:

hydra -l 588455 -P passwords.txt site.com http-post-form "/auth/login:username=^USER^&password=^PASS^:Désolé : Vos détails de connexion n'ont pas été reconnus, réessayer."

So my questions are like this:

1) Am I doing anything wrong regarding the command above?

2) Since the failed error is too long and contains chars as "é , :" Can I adapt Hydra to recognise only part of the error string, such as "Désolé" only?

3) When the login attempt is valid, no success/failure are retuned, just the user is redirected from site.com/auth to site.com/home .so can I make Hydra notice when the user is redirected to /home and upon that decides if a password is valid or not? If yes, how can I do so?

4) I have read in Hydra docs that I can use the cookie arg to check if the login is a success on not, any idea or example oh how to do so? Much thanks and apprecation in advance everyone, I hope I get some insights.

A success login does the following: redirects to http://site.com/profile ans sets the Cookie: ci_session=e6971c0d444819e261cbfa89182f5da10ccc8bb0

Answer 1

Typically you'd want your match string to just be long enough to prevent any false negatives/positives and nothing more. Given that your string includes accented characters, I would also strongly recommend checking how the landing page renders them. Hydra will be looking at the HTML source, not how a browser would render it. It's possible that é is written as é in the HTML source code.

Furthermore, given that your login only redirects on successful logins, it may be worth checking for the positive case (login successful) instead of the negative case (login failed). Hydra will follow redirects, so you could match text that only appears on the landing page (e.g. the presence of a "log out" button). You can find details on using a positive test case here.

As for cookie matching, Hydra appears to search the entire HTTP response, headers included. That said, the cookie value you posted is unlikely to be useful. It's a session cookie which is meant to be unique to each visitor of the website. Most websites will set a session cookie even if the visitor isn't logged in. While it may be the session cookie assigned to your successful test login, it's astronomically unlikely that it'll ever be that same value again.