I am having a bit of a pickle getting hydra to see the correct password when the page is redirected. The condition where the password is correct is if the login is redirected to a certain page in the root test site.

I am using the below command

`hydra -l username -P passwordlist https-post-form "/index.php:UserName=^USER^&Password=^PASS^&submit=logout:invalid" -vV -f`

While hydra performs this command, it shows that the page has redirected to another page. Just as it had tested the correct password which I previously set.

How can I tune this hydra command to be able to stop and find the correct password after it has been redirected?

  • by the way, currently it shows me that no valid passwords are found yet the correct password is in the list. and it only shows me that the page have been redirected. but doesnt highlight the correct password. – Greenman Jul 9 '18 at 2:09

Without seeing your test webpage it's hard to say. However, looking at Hydra's source code, it appears to follow redirects and eventually inspects the content of the final page (assuming it didn't hit the redirect limit).

As for the HTTP module's options, you can specify a pass or fail criteria.

The option field (following the service field) takes three ":" separated
values and an optional fourth value, the first is the page on the server
to GET or POST to, the second is the POST/GET variables (taken from either
the browser, or a proxy such as PAROS) with the varying usernames and passwords
in the "^USER^" and "^PASS^" placeholders, the third is the string that it
checks for an *invalid* or *valid* login - any exception to this is counted
as a success.
So please:
 * invalid condition login should be preceded by "F="
 * valid condition login should be preceded by "S=".
By default, if no header is found the condition is assume to be a fail,
so checking for *invalid* login.

Your current pattern considers the password a failure if the resulting page contains "invalid". Given that correct logins redirect, it may be better to instead search for a "pass" condition instead by prefixing the pattern with S=.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.