Brute-Forcing DVWA login page with hydra - csrf incorrect

Question

I'm learning how to use hydra, but I found a problem.

When I run the following script, I get a CSRF token error. Apparently, the problem is that the token received in CURL is different from the one in hydra.

Step by step:

I have created this docker-compose.yml file:

version: '3.8'
services:
  web-dvwa:
    container_name: dvwa
    image: vulnerables/web-dvwa:latest
    ports:
      - 127.0.0.1:8001:80

And after that, I had installed hydra (Hydra v9.5-dev) and created a bash script:

#!/bin/bash
CSRF=$(curl -s -c dvwa.cookie "127.0.0.1:8001/login.php" | awk -F 'value=' '/user_token/ {print $2}' | cut -d "'" -f2)
SESSIONID=$(grep PHPSESSID dvwa.cookie | awk -F ' ' '{print $7}')

hydra 127.0.0.1 -s 8001 \
    -l admin -p password \
    http-post-form "/login.php:username=^USER^&password=^PASS^&Login=Login&user_token=${CSRF}:H=Cookie\: PHPSESSID=${SESSIONID}; security=weak:S=index.php" \
    -vVd

This solution would work but I have got a CSRF token invalid error.

Error track (I think):

1. get CSRF and SESSIONID by CURL

2. run hydra

3. hydra: send a GET (changed CSRF form token)

4. hydra: send POST request

5. hydra: send recevied GET

   dvwa | 192.168.32.1 - - [22/Dec/2022:07:19:27 +0000] "GET /login.php HTTP/1.1" 200 1937 "-" "curl/7.81.0"

   dvwa | 192.168.32.1 - - [22/Dec/2022:07:19:27 +0000] "GET /login.php HTTP/1.0" 200 1898 "-" "Mozilla/5.0 (Hydra)"

   dvwa | 192.168.32.1 - - [22/Dec/2022:07:19:27 +0000] "POST /login.php HTTP/1.0" 302 384 "-" "Mozilla/5.0 (Hydra)"

   dvwa | 192.168.32.1 - - [22/Dec/2022:07:19:27 +0000] "GET /login.php HTTP/1.0" 200 1948 "-" "Mozilla/5.0 (Hydra)"

How to resolve this problem? Thank you!

Answer 1

"dvwa" generates a new CSRF token for each each response. This is how CSRF protection should work. Where as in your script you extract it only once. Thus only your first request from "hydra" uses a correct CSRF token. All subsequent requests use an outdated CSRF token.

What can you do? Use some other tool, e.g. potator. Or create your own script in Python. The latter will have an advantage, that you will learn a lot about security in web applications.