Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
I want to brute-force a site using Hydra (https-post-form) that I don't know valid login credentials for, so I cannot specify a value for success condition (S=).
Failed logins result in a redirect to one of two different failure pages with no words in common.
How can I specify multiple values to F=, e.g., F=(fail)|(tak) (regular expression)?
Assuming Hydra was compiled with PCRE (regular expression) support, the pattern you supply should be treated as a regular expression. You should be able to use | as a pattern "or" operator.
Here's the relevant source code: https://github.com/vanhauser-thc/thc-hydra/blob/eb064c4222964ecac9dc757ad8c847b130c43deb/hydra-http-form.c#L563-L567
You can tell if Hydra was not compiled with PCRE support because it will specifically mention "regex support" on the "These services were not compiled" list: https://github.com/vanhauser-thc/thc-hydra/blob/eb064c4222964ecac9dc757ad8c847b130c43deb/hydra.c#L2142-L2146
If you don't have PCRE support, you'll need to recompile Hydra from the repository.
-h flag, it'll show you all the available options and all of the unavailable modules. If you see regular expressions in the unavailable list, then you do not have regular expression support.
– Mr. Llama
Jul 14 '18 at 17:07
These services were not compiled in: afp ncp oracle sapr3.. Nothing is said about features, like regular expression, not compiled in?
– Shuzheng
Jul 14 '18 at 17:57
