I'm running Hydra against a vulnerable VM running on my own server. I'm trying to find the password for the "admin" username.
This is the command I ran:
hydra -vV -l admin -P /root/Documents/000webhost.txt 10.0.2.10 http-post-form '/wordpress/wp-login.php:log=^USER^&pwd=^PASS^&wp-submit=Log+In:F=is incorrect'
After sometime running, I got this message:
[http-post-form] host: 10.0.2.10 login: admin [STATUS] attack finished for 10.0.2.10 (waiting for children to complete tests) 1 of 1 target successfully completed, 1 valid password found Hydra (http://www.thc.org/thc-hydra) finished at 2017-12-27 18:12:43
It says it found the password, but it does not show that password.
Usually the password is shown in the line that also says "login: admin".
Any idea of whats going on? Thanks.
I seam to have found the issue. There is an empty line/password (i.e. "") in the file. This empty password is shown to be attempted 19 lines before the "result" output:
[ATTEMPT] target 10.0.2.10 - login "admin" - pass "" - 15067 of 720303 [child 10] (0/0)
I inputted the "" as the password directly in the target web app and the response it gives is different from "is incorrect", thus causing the false positive. What is strange is that Hydra does not output it.
I created a smaller passwords file with an empty line, and the issue was repeated. I then removed the empty line from the file and ran Hydra again, this time without getting the false positive.