2

I've updated Kali 2.0 to newest version - it is installed using VMWare.

Now, every time I use hydra to brute-force SSH, I get the following error:

[ERROR] target ssh://192.168.16.128:22/ does not support password authentication.

The corresponding command is as follows:

hydra -l anne -P /usr/share/wordlists/rockyou.txt 192.168.16.128 -t 32 ssh

I can easily log into the SSH server (tried a couple of servers) using ssh (ssh [email protected]) and entering the password.

I really have no idea what could be wrong? Every tutorial I read on the Internet seems to work flawlessly without the issues I'm experiencing...

The complete session can be seen below:

root@kali:~# hydra -l anne -P /usr/share/wordlists/rockyou.txt 192.168.16.128 -t 32 ssh
Hydra v8.6 (c) 2017 by van Hauser/THC - Please do not use in military or secret service organizations, or for illegal purposes.

Hydra (http://www.thc.org/thc-hydra) starting at 2018-04-16 19:30:56
[WARNING] Many SSH configurations limit the number of parallel tasks, it is recommended to reduce the tasks: use -t 4
[DATA] max 32 tasks per 1 server, overall 32 tasks, 14344399 login tries (l:1/p:14344399), ~448263 tries per task
[DATA] attacking ssh://192.168.16.128:22/
[ERROR] target ssh://192.168.16.128:22/ does not support password authentication.

2 Answers 2

1

SSH supports several different authentication mechanisms. The password authentication mechanism has the client send the password to the server as a password. The more-common keyboard-interactive authentication mechanism opens a channel between the client and an authentication process on the server. The client allows the user to directly interact with the authentication process, which is usually just a password prompt. This allows more complex features like multiple-factor authentication and pre-authentication warnings and checks.

So your target probably supports keyboard-interactive and not password authentication.

2
  • How do I tell Hydra to use keyboard-interactive, if that is even possible?
    – Shuzheng
    Commented Apr 17, 2018 at 8:04
  • @Shuzheng hydra is pretty out-dated and in my opinion, you can't. Anyway make sure yourself that server is using keyboard-interactive by trying to enumerate auth methods supported with: "nmap --script ssh-auth-methods IP"
    – Virgula
    Commented Apr 27, 2020 at 14:39
0

Your timing option needs to move in front of your host/protocol. Try this:

hydra -l anne -P /usr/share/wordlists/rockyou.txt -t 32 ssh://192.168.16.128

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .