0

So here it is, I had time to kill, so I used it to hack into my own gmail address with THC Hydra. (very fun I know). So I checked out some old forums and gradually learned how to do it. I understood the overall functioning of THC Hydra, whether it is the dictionary system or brutforce, the password and user lists. But many obstacles have stood in my way and are still standing, starting with the language barrier. There is also the phpsessid cookie that I can't systematically find or differentiate between the different servers (smtp, ssl, ftp etc...). However, my main one is this one: By creating a password list with a single password (the correct one) and by creating a user list with a single user (the correct one), THC Hydra makes endless attempts and comes to the conclusion (or not) that no password corresponds or comes to any conclusion. So I guess I have to configure some parameters, especially when a password is wrong, and when a password is correct. I have to use the phpsessid, don't I? How to ingest it in Hydra? How can he differentiate between the fake and the real? Have I forgotten a crucial point when setting up?

Attached are some codes and results I tried

I am very ignorant about the use, so I gladly accept any criticism and help from you

Sincerely

(c) 2019 Microsoft Corporation. Tous droits réservés.
Les ressources mémoire disponibles sont insuffisantes pour traiter cette commande.

C:\Users\0ph10\Desktop\kit\brut\THCHydra\ThcHydraMaster>hydra -l C:\Users\0ph10\Desktop\kit\brut\THCHydra\passlist\users.txt -P C:\Users\0ph10\Desktop\kit\brut\THCHydra\passlist\psw.txt -e ns -V -s 465 smtp.gmail.com smtp
Hydra v8.1 (c) 2014 by van Hauser/THC - Please do not use in military or secret service organizations, or for illegal purposes.

Hydra (http://www.thc.org/thc-hydra) starting at 2019-09-04 20:59:48
[INFO] several providers have implemented cracking protection, check with a small wordlist first - and stay legal!
[WARNING] Restorefile (./hydra.restore) from a previous session found, to prevent overwriting, you have 10 seconds to abort...
[DATA] max 3 tasks per 1 server, overall 64 tasks, 3 login tries (l:1/p:3), ~0 tries per task
[DATA] attacking service smtp on port 465
[ATTEMPT] target smtp.gmail.com - login "C:\Users\0ph10\Desktop\kit\brut\THCHydra\passlist\users.txt" - pass "C:\Users\0ph10\Desktop\kit\brut\THCHydra\passlist\users.txt" - 1 of 3 [child 0]
[ATTEMPT] target smtp.gmail.com - login "C:\Users\0ph10\Desktop\kit\brut\THCHydra\passlist\users.txt" - pass "" - 2 of 3 [child 1]
[ATTEMPT] target smtp.gmail.com - login "C:\Users\0ph10\Desktop\kit\brut\THCHydra\passlist\users.txt" - pass "PasswordtestHydra" - 3 of 3 [child 2]
[RE-ATTEMPT] target smtp.gmail.com - login "C:\Users\0ph10\Desktop\kit\brut\THCHydra\passlist\users.txt" - pass "C:\Users\0ph10\Desktop\kit\brut\THCHydra\passlist\users.txt" - 3 of 4 [child 0]
[RE-ATTEMPT] target smtp.gmail.com - login "C:\Users\0ph10\Desktop\kit\brut\THCHydra\passlist\users.txt" - pass "" - 3 of 4 [child 1]
[STATUS] 3.00 tries/min, 3 tries in 00:01h, 1 todo in 00:01h, 3 active
[REDO-ATTEMPT] target smtp.gmail.com - login "C:\Users\0ph10\Desktop\kit\brut\THCHydra\passlist\users.txt" - pass "PasswordtestHydra" - 4 of 6 [child 2]
[REDO-ATTEMPT] target smtp.gmail.com - login "C:\Users\0ph10\Desktop\kit\brut\THCHydra\passlist\users.txt" - pass "C:\Users\0ph10\Desktop\kit\brut\THCHydra\passlist\users.txt" - 5 of 6 [child 0]

closed as off-topic by Xander, Jeroen, Conor Mancone, MechMK1, LvB Sep 5 at 14:02

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions asking us to break the security of a specific system for you are off-topic unless they demonstrate an understanding of the concepts involved and clearly identify a specific problem." – Xander, Jeroen, Conor Mancone, MechMK1, LvB
If this question can be reworded to fit the rules in the help center, please edit the question.

  • There are no cookies and thus also no phpsessid cookie when using the SMTP protocol as you do. Cookies are a property of HTTP/HTTPS protocols only. – Steffen Ullrich Sep 4 at 19:19
  • 1
    These type of attacks are not appreciated by either Google or Stack Exchange. It is about breaking the security of a system that is not owned by you. Even thought it might be your account, you'll need explicit permission to use tools like this on public services like this. – Jeroen Sep 4 at 20:58
1

You have mentioned that you are using a file for single user and another file for single password.

  • Users File: C:\Users\0ph10\Desktop\kit\brut\THCHydra\passlist\users.txt
  • Passwords File: C:\Users\0ph10\Desktop\kit\brut\THCHydra\passlist\psw.txt

But you have used the switch -l instead of -L to specify the users file . Refer user$hydra -h for more help.

Not the answer you're looking for? Browse other questions tagged or ask your own question.