I am using Hydra to brute force a login http form (Method: post), but I'm getting false positives (passwords that aren't valid)

I believe I know the reason, I just don't know how to handle it: The failure of the request produces the following failed message containing strings as "é":

(the error is only printed on the screen, nothing in the url.) "Desolé: Vos détails de connexion n'ont pas été réconnus, réessayer." (this is the error you get when submititng invalide credentials.

So I have read that the string lenght and format affects how Hydra responds. This is the how command I execute:

hydra -l 588455 -P passwords.txt site.com http-post-form "/auth/login:username=^USER^&password=^PASS^:Désolé : Vos détails de connexion n'ont pas été reconnus, réessayer."

So my questions are like this:

1) Am I doing anything wrong regarding the command above?

2) Since the failed error is too long and contains chars as "é , :" Can I adapt Hydra to recognise only part of the error string, such as "Désolé" only?

3) When the login attempt is valid, no success/failure are retuned, just the user is redirected from site.com/auth to site.com/home .so can I make Hydra notice when the user is redirected to /home and upon that decides if a password is valid or not? If yes, how can I do so?

4) I have read in Hydra docs that I can use the cookie arg to check if the login is a success on not, any idea or example oh how to do so? Much thanks and apprecation in advance everyone, I hope I get some insights.

A success login does the following: redirects to http://site.com/profile ans sets the Cookie: ci_session=e6971c0d444819e261cbfa89182f5da10ccc8bb0

Typically you'd want your match string to just be long enough to prevent any false negatives/positives and nothing more. Given that your string includes accented characters, I would also strongly recommend checking how the landing page renders them. Hydra will be looking at the HTML source, not how a browser would render it. It's possible that é is written as é in the HTML source code.

Furthermore, given that your login only redirects on successful logins, it may be worth checking for the positive case (login successful) instead of the negative case (login failed). Hydra will follow redirects, so you could match text that only appears on the landing page (e.g. the presence of a "log out" button). You can find details on using a positive test case here.

As for cookie matching, Hydra appears to search the entire HTTP response, headers included. That said, the cookie value you posted is unlikely to be useful. It's a session cookie which is meant to be unique to each visitor of the website. Most websites will set a session cookie even if the visitor isn't logged in. While it may be the session cookie assigned to your successful test login, it's astronomically unlikely that it'll ever be that same value again.

  • Yes, you are correct about the cookie, when I try a failed login try I get 4 cookies including the one above. I delete all cookies and then successfully login with a valid account I get another the same 4 cookies names but with a different hash (which is normal of course) 3 values of the three other cookies ,excluding the one I mentioned earlier, have the same values in both failed/success logins. So I wonder if they check whether the cookie is valid with each request/reload or what? – Murphy Adam Jul 13 at 21:25
  • And yeah also a part of the style of error returned on the page is bold (<stong> Désolé : </Désolé> Vos....end of error ... do you thing this has to do with why Hydra is acing like that? what I too found is that the website is using a google service named googletagmanager.com/gtag/js?id=UA-112040478-1 and one of the 4 cookies is named regarding that service: _gat_gtag_UA_112040478_1 – Murphy Adam Jul 13 at 21:27
  • @MurphyAdam - Hydra isn't looking at how the page is rendered, it's just looking at the raw page source. It has no idea the text is in bold or in tags. If you need it to match something in tags, include those tags in your pattern. – Mr. Llama Jul 14 at 16:44

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.