I am using Hydra to brute force a login http form (Method: post), but I'm getting false positives (passwords that aren't valid)
I believe I know the reason, I just don't know how to handle it: The failure of the request produces the following failed message containing strings as "é":
(the error is only printed on the screen, nothing in the url.)
"Desolé: Vos détails de connexion n'ont pas été réconnus, réessayer." (this is the error you get when submititng invalide credentials.
So I have read that the string lenght and format affects how Hydra responds. This is the how command I execute:
hydra -l 588455 -P passwords.txt site.com http-post-form "/auth/login:username=^USER^&password=^PASS^:Désolé : Vos détails de connexion n'ont pas été reconnus, réessayer."
So my questions are like this:
1) Am I doing anything wrong regarding the command above?
2) Since the failed error is too long and contains chars as "é , :" Can I adapt Hydra to recognise only part of the error string, such as "Désolé" only?
3) When the login attempt is valid, no success/failure are retuned, just the user is redirected from site.com/auth to site.com/home .so can I make Hydra notice when the user is redirected to /home and upon that decides if a password is valid or not? If yes, how can I do so?
4) I have read in Hydra docs that I can use the cookie arg to check if the login is a success on not, any idea or example oh how to do so? Much thanks and apprecation in advance everyone, I hope I get some insights.
A success login does the following: redirects to http://site.com/profile ans sets the Cookie: ci_session=e6971c0d444819e261cbfa89182f5da10ccc8bb0