2

I was performing a Hydra attack on my TP-Link router and for that I prepared a passwords.txt file with 288 passwords.

hydra -l webadmin -P test_creds/passwords.txt xxx.xxx.xxx.xxx ftp

A minute after I set Hydra off it showed me the following message:

[STATUS] 405.00 tries/min, 405 tries in 00:01h, 18446744073709551500 todo in 5124095576030430:60h

What I don't understand is what 405 tries in 00:01h and 18446744073709551500 todo in 5124095576030430:60h mean. As I understand it, Hydra is telling me that it's about to make 5124095576030430 login attempts in 60 hours. But mathematically speaking when you combine 288 passwords with 1 username you get a total of 288 * 1 credentials and if, as shown in it's first output, it is attempting 405.00 tries/min it should only take around 43 seconds to try all of them. Now, that's not what's happening. So what do those numbers mean?

  • have you tried: hydra -l webadmin -P test_creds/passwords.txt ftp://xxx.xxx.xxx.xxx ? – schroeder Jul 27 '18 at 21:06
  • I did what you said and this was the first output [STATUS] 409.00 tries/min, 409 tries in 00:01h, 18446744073709551496 todo in 5124095576030430:60h, 16 active – Mike Jul 28 '18 at 14:24
  • I'm trying to sort out why it wants to test more than 288 combinations. My next guess is that the passwords.txt that you want it to use is not the file that it is picking up. Try moving the passwords.txt file to your cwd and changing your command to match? – schroeder Jul 28 '18 at 16:47
  • Yeah, that is the output I got when I ran the command from the directory where passwords.txt is in – Mike Jul 28 '18 at 19:31
0

You are misinterpreting the output.

5124095576030430:60h is not a ratio of tries to the number of hours. That's the number of hours it is going to take.

The number of tries is plainly explained:

18446744073709551500 in 5124095576030430:60h

If you are expecting only 288 attempts, then it looks like you have misconfigured your command.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.