I'm learning how to brute force web login pages with a popular brute force tool called "Hydra". I'm using Kali Linux (VirtualBox) to do this. I've installed DVWA (Damn Vulnerable Web Application) and I'm running it locally.
NOTE: I'm trying to brute force
/DVWA/login.php (the actual DVWA login page) not
/DVWA/vulnerabilities/brute/ (the brute force challenge)
Here's the Burp Suite info
POST /DVWA/login.php HTTP/1.1 Host: localhost User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Referer: http://localhost/DVWA/login.php Cookie: security=impossible; PHPSESSID=72mh5pvdosgo98nmij6dha4min Connection: close Upgrade-Insecure-Requests: 1 Content-Type: application/x-www-form-urlencoded Content-Length: 77 username=e&password=e&Login=Login&user_token=5e093d39eb72145d6b0b2de187340825
I used Burp Suite to intercept the request and get the information needed, with that info I constructed the following command:
hydra -l admin -P /usr/share/dirb/wordlists/dvwa.txt localhost http-post-form "/dvwa/login.php:username=^USER^&password=^PASS^&Login=Login:Login failed" -V
dvwa.txt is just a text file with two passwords: password1 and password (the correct password to the login is password). When I ran hydra it returned with this:
Hydra (http://www.thc.org/thc-hydra) starting at 2018-10-06 09:48:12 [DATA] max 2 tasks per 1 server, overall 2 tasks, 2 login tries (l:1/p:2), ~1 try per task [DATA] attacking http-post-form://localhost:80//dvwa/login.php:username=^USER^&password=^PASS^&Login=Login:Login failed [ATTEMPT] target localhost - login "admin" - pass "password1" - 1 of 2 [child 0] (0/0) [ATTEMPT] target localhost - login "admin" - pass "password" - 2 of 2 [child 1] (0/0) [http-post-form] host: localhost login: admin password: password [http-post-form] host: localhost login: admin password: password1 1 of 1 target successfully completed, 2 valid passwords found Hydra (http://www.thc.org/thc-hydra) finished at 2018-10-06 09:48:13
This result is not accurate, password1 is not a valid password, password is a valid password though. What am I doing wrong? I modelled my command according to this website.
Am I missing something? I notice that the website above did not put localhost in their command but rather an IP? I'm running DVWA locally on my computer so I put localhost. If you could please be as clear and detailed as possible that would be awesome! I'm new to Hydra, Kali Linux, and brute forcing!