3

I have a D-Link DCS 5222LB IP camera. I am trying to bruteforce the IP camera. The camera uses basic HTTP authentication. I use the following command:

hydra -l admin -P passlist.txt -t 3  http://IP_address

The issue is that if I run this command with a difference of 3 minutes, hydra gives me the right password otherwise it gives me wrong password.

I have inspected the network packets to find if it uses the Form method but, what I found is that my camera server gives same response if the password is right or wrong and hydra does not know which is the successful response and which is not.

Kindly tell me is there any way through which I can tell my hydra (without using http-post-form) the diference between right and wrong response?

2

I Have figured out the issue. Hydra considers 401 as the Fail Response and 200 as the "Success" response. It also considers 403 as success response. My IP-Camera is smart enough to identify that hydra is trying to bruteforce. At the start, it returns 401 for the wrong passwords and 200 for the correct password. If I try again immediately, it figures out that something fishy is going on here and responds with 403 instead of 401 (Hydra takes 403 as a success response). If I wait for 3 or more minutes, It starts responding with 401 again.

  • You can accept your own answers by clicking the checkmark – Tophandour Sep 28 '18 at 15:12
0

Firstly, you should confirm it is really using Basic Auth by checking with wget -S or curl -i (or alternatively packet inspection) that it returns a HTTP 401 with a WWW-Authenticate: header. hydra is hard to use, the less guesswork setting it up the better. I usually capture both a successful and a failed login via an intercepting proxy to make sure.

Secondly, are you certain you're using a recent and official (thc) hydra? The -t option is for concurrency, not any type of time limit, and most importantly a plain "http://" is not supported, you need to explicitly use "http-get://" for this. If you are using a GUI, perhaps it is second-guessing you and providing alternate arguments to the real hydra.

Unlike the http-form* modules which require a "success" string to match within the reply content, the http-get module assumes success with a HTTP 2xx, 3xx, 403, or 404 codes.

Given that the target device is a camera, a single task is probably best, and you might even have to slow it down to get reliable results (see hydra options -W and -c).

  • Thanks alot for your valuable comments. I have confirmed that it is really using Basic Auth (through looking at packet and wget -S as well). Now, the thing is that failure result is 401 while succes result is 200 OK. I am stuck at how do I tell my hydra about this? Because it is not like http-form where i can give it a success string. – Asad Jul 30 '18 at 5:53
  • P.S. You are right that -t is for not for time (sorry it was my mistake). The thing is that if I give the command hydra -l user -P passlist.txt http-get://192.xxxxxx, I get the right password. But when I give the command again, It gives wrong password. If I wait for 3 or minutes before giving the command again, It again gives the right password. – Asad Jul 30 '18 at 5:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.