0

I've updated Kali 2.0 to newest version - it is installed using VMWare.

Now, every time I use hydra to brute-force SSH, I get the following error:

[ERROR] target ssh://192.168.16.128:22/ does not support password authentication.

The corresponding command is as follows:

hydra -l anne -P /usr/share/wordlists/rockyou.txt 192.168.16.128 -t 32 ssh

I can easily log into the SSH server (tried a couple of servers) using ssh (ssh anne@192.168.16.128) and entering the password.

I really have no idea what could be wrong? Every tutorial I read on the Internet seems to work flawlessly without the issues I'm experiencing...

The complete session can be seen below:

root@kali:~# hydra -l anne -P /usr/share/wordlists/rockyou.txt 192.168.16.128 -t 32 ssh
Hydra v8.6 (c) 2017 by van Hauser/THC - Please do not use in military or secret service organizations, or for illegal purposes.

Hydra (http://www.thc.org/thc-hydra) starting at 2018-04-16 19:30:56
[WARNING] Many SSH configurations limit the number of parallel tasks, it is recommended to reduce the tasks: use -t 4
[DATA] max 32 tasks per 1 server, overall 32 tasks, 14344399 login tries (l:1/p:14344399), ~448263 tries per task
[DATA] attacking ssh://192.168.16.128:22/
[ERROR] target ssh://192.168.16.128:22/ does not support password authentication.
| improve this question | | | | |
1

SSH supports several different authentication mechanisms. The password authentication mechanism has the client send the password to the server as a password. The more-common keyboard-interactive authentication mechanism opens a channel between the client and an authentication process on the server. The client allows the user to directly interact with the authentication process, which is usually just a password prompt. This allows more complex features like multiple-factor authentication and pre-authentication warnings and checks.

So your target probably supports keyboard-interactive and not password authentication.

| improve this answer | | | | |
  • How do I tell Hydra to use keyboard-interactive, if that is even possible? – Shuzheng Apr 17 '18 at 8:04
  • @Shuzheng hydra is pretty out-dated and in my opinion, you can't. Anyway make sure yourself that server is using keyboard-interactive by trying to enumerate auth methods supported with: "nmap --script ssh-auth-methods IP" – Virgula Apr 27 at 14:39
0

Your timing option needs to move in front of your host/protocol. Try this:

hydra -l anne -P /usr/share/wordlists/rockyou.txt -t 32 ssh://192.168.16.128
| improve this answer | | | | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.