I am trying to brute force an HTTP login form via Hydra.

The problem I am having is in regards to the response code returned by the page. I am receiving false positives on every password.

Even failed logins return HTTP 200 responses, which I believe is leading to false positives.

How can I alter hydra to look for something like content-length header or a unique string returned to avoid the false positives?

  • in the hydra command you use, you specify what hydra is to look for to determine if the login was successful
    – schroeder
    Jul 17 '18 at 15:11
  • @schroeder unfortunately i do not know what success looks like. I just know if it fails, what html is rendered
    – Hysii
    Jul 17 '18 at 15:17
  • 2
    Then the problem is not the 200 response, but your understanding of the system.
    – schroeder
    Jul 17 '18 at 15:29

Getting a 200 response is fine. You need to tell Hydra what to look for in the response page.

For example, if I log into SocialSite.com/login.php and my creds are wrong, the login page will return with a message of Bad username or password!

You can do this by adding some of this text to the end of your hydra command

hydra http-form-post "socialsite.com/login.php:user=^USER^&pass=^PASS^:Bad username" ...

notice at the end of the http-form-post arg there's :Bad username" That tells hydra to look for that text in the response.

Here's a full example for you to reference

  • I did this, as entering poor credentials renders a tag that says "Login Error". So, exactly as you did, added Login Error at the end....and I am still getting false positives :(
    – Hysii
    Jul 17 '18 at 15:26
  • 1
    @Hysii I would look more at what you're doing then because this is the answer. Maybe there's a piece of the picture you're missing Jul 17 '18 at 15:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.