Trying for the life of me to get Hydra to work with a JSON request.


Response Headers:

  • Access-Control-Allow-Methods: GET, POST

Request Headers:

Request Payload:

{username: "root", password: "toor"}
password: "toor"
username: "root"

Response for Invalid Login: {"error":"username or password incorrect"}

I have tried many iterations, but keep getting the following error message: Receiving the following error message: [ERROR] Invalid target definition!

hydra https://api.myapp.app https-form-post "api/account/login:username=^USER^&password=^PASS^:F={\"error:\" \"username \" \"or \" \"password \" \"wrong\"}" -l root -p toor
  • Welcome to Information Security StackExchange! FYI, you can edit your post to fix it. – AndrolGenhald Feb 13 '19 at 15:03

I could not get the Hydra command to work, but I did learn about patator, https://github.com/lanjelot/patator, which worked.

Patador command: python patator.py http_fuzz url=https://api.myapp.app/api/login/ method=POST body='username=root&password=FILE0' 0=/home/[your dictionary file]

If anyone is a Hyrda expert, I am still interested in learning how to use Hydra for the same. While the patator tool works, I am not sure it supports rate limits and other features found in Hydra. Thank you.

|improve this answer|||||

I can't imagine hydra not working for the scenario you are trying to use it for. This post speaks as to why you might be seeing the Invalid target defintion error.

Try adjusting the hydra command and removing the http:// prepended to your API URL.

Full example:

hydra -l root -p toor api.myapp.app https-form-post "/api/accounts/login:username=^USER^&password=^PASS^:F={\"error:\" \"username \" \"or \" \"password \" \"wrong\"}"

The above command can be further updated by replacing the -p flag with a -P for loading a password file.

-tested on hydra v8.6-

Harder to help further debug as we cannot reproduce but this should address at least your immediate issue.

|improve this answer|||||

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.