1

Very new to application testing here. I am working through the hacker101 CTF (petshop) examples and I am having problems with brute forcing a username form with Hydra. The error message looks like it stalls while trying the first 16 entries in the wordlist.

Below is the command I am using:

hydra -L femalenames-usa-top1000.txt
      -p pword
      34.94.3.143
      -u http-post-form "/c1b61e72b8/login:username=^USER^&password=^PASS^:F=Invalid:H=Cookie: session=eyJjYXJ0IjpbXX0.XaBd8w.9_TDw2elp3zqFFDAnu_dZmZO_ZY"
      -vV

I have tried it with and without the cookie and I get the same response.

[ATTEMPT] target 34.94.3.143 - login "HELEN" - pass "pword" - 15 of 1000 [child 14] (0/0)

[ATTEMPT] target 34.94.3.143 - login "SANDRA" - pass "pword" - 16 of 1000 [child 15] (0/0)

[STATUS] 16.00 tries/min, 16 tries in 00:01h, 984 to do in 01:02h, 16 active

[STATUS] 5.33 tries/min, 16 tries in 00:03h, 984 to do in 03:05h, 16 active

[STATUS] 2.29 tries/min, 16 tries in 00:07h, 984 to do in 07:11h, 16 active

[STATUS] 1.33 tries/min, 16 tries in 00:12h, 984 to do in 12:19h, 16 active

I realise if I change any part of the URL or IP address, there are no changes to the result, so I'm not sure if it is even connecting to the server.

I am using Kali linux, I uninstalled hydra and reinstalled the latest version from git.

I have tried on 3 different Internet connections.

Please could I have assistence in getting the command to not stall and process the wordlist.

Improve this question
  • Hello konk and welcome to Stack Exchange and Information Security in general. I edited your question to make it more readable, but your question still reads more like a general call for help and less like a concretely answerable question. Please edit your question and try to formulate a clear question, both in the title and the body of the question. – MechMK1 Oct 11 '19 at 12:31
  • 1
    Furthermore, are you sure that the challenge you are facing is supposed to be solved by brute force? There may be a different way to solve the challenge. Keep in mind that a CTF, especially an entry-level challenge, tries to teach you something. By using automation tools, you might not actually get the knowledge out of the challenge that you are supposed to get. – MechMK1 Oct 11 '19 at 12:33
  • Thanks. I guess I went down this route as I saw some examples that used the techique successfully for this challenge. May be I should explore a few other methods as well. – konk Oct 11 '19 at 12:46
  • Most entry-level challenges identify some common theme or technique it's aimed to teach. Perhaps the description of the challenge has some hints. – MechMK1 Oct 11 '19 at 12:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.