I have been trying for days now to use Hydra in an attempt to crack DVWA brute force but to no avail, I am using the correct session cookie and to my knowledge have the correct syntax?

Query is:

hydra -l admin -P /usr/share/set/src/fasttrack/wordlist.txt http-get-form "/DVWA/vulnerabilites/brute/index.php:username=^USER^&password=^PASS^&Login=Login:Username and/or password incorrect.:H=Cookie: security=low;PHPSESSID=4m58apmmrijdonaib95nac6ld7"

Output is enter image description here

I do know it can find my password list however I am unsure if it is correctly finding the page to brute force on, desperate for a fix!

  • 16 valid passwords found suggests it thinks each attempt is successful. Have you tried reducing your match string to "password incorrect"? – Hector Dec 4 '17 at 8:12
  • yeah I believe that it might not be hitting the correct page or area, I tried that by shortening the denial query but no cigar – user165319 Dec 4 '17 at 8:29
  • And the case is correct? It might be worth trying a success match to attempt to work out what page its hitting. I.e if ":S=This is only on the home page". Alternatively if you have enough knowledge of the underlying protocols i'd suggest using something like wireshark to see exactly what is being sent. – Hector Dec 4 '17 at 8:34
  • Yeah I believe the case is correct, I tried hardcoding the query to debug, first with the incorrect password in the -P password section and the second being the correct password so one would think that it is hitting the correct page. error that comes back on the incorrect password is [ERROR] File for passwords not found: password1 – user165319 Dec 4 '17 at 8:44
  • I can't do any checking myself, but shouldn't the match string be in quotes so with " "? Not sure though – Wealot Dec 4 '17 at 13:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy