Hydra gives right password if used after 3 minutes else gives wrong passwords

Question

I have a D-Link DCS 5222LB IP camera. I am trying to bruteforce the IP camera. The camera uses basic HTTP authentication. I use the following command:

hydra -l admin -P passlist.txt -t 3  http://IP_address

The issue is that if I run this command with a difference of 3 minutes, hydra gives me the right password otherwise it gives me wrong password.

I have inspected the network packets to find if it uses the Form method but, what I found is that my camera server gives same response if the password is right or wrong and hydra does not know which is the successful response and which is not.

Kindly tell me is there any way through which I can tell my hydra (without using http-post-form) the diference between right and wrong response?

Answer 1

I Have figured out the issue. Hydra considers 401 as the Fail Response and 200 as the "Success" response. It also considers 403 as success response. My IP-Camera is smart enough to identify that hydra is trying to bruteforce. At the start, it returns 401 for the wrong passwords and 200 for the correct password. If I try again immediately, it figures out that something fishy is going on here and responds with 403 instead of 401 (Hydra takes 403 as a success response). If I wait for 3 or more minutes, It starts responding with 401 again.

Answer 2

Firstly, you should confirm it is really using Basic Auth by checking with wget -S or curl -i (or alternatively packet inspection) that it returns a HTTP 401 with a WWW-Authenticate: header. hydra is hard to use, the less guesswork setting it up the better. I usually capture both a successful and a failed login via an intercepting proxy to make sure.

Secondly, are you certain you're using a recent and official (thc) hydra? The -t option is for concurrency, not any type of time limit, and most importantly a plain "http://" is not supported, you need to explicitly use "http-get://" for this. If you are using a GUI, perhaps it is second-guessing you and providing alternate arguments to the real hydra.

Unlike the http-form* modules which require a "success" string to match within the reply content, the http-get module assumes success with a HTTP 2xx, 3xx, 403, or 404 codes.

Given that the target device is a camera, a single task is probably best, and you might even have to slow it down to get reliable results (see hydra options -W and -c).