Very new to application testing here. I am working through the hacker101 CTF (petshop) examples and I am having problems with brute forcing a username form with Hydra. The error message looks like it stalls while trying the first 16 entries in the wordlist.
Below is the command I am using:
hydra -L femalenames-usa-top1000.txt -p pword 184.108.40.206 -u http-post-form "/c1b61e72b8/login:username=^USER^&password=^PASS^:F=Invalid:H=Cookie: session=eyJjYXJ0IjpbXX0.XaBd8w.9_TDw2elp3zqFFDAnu_dZmZO_ZY" -vV
I have tried it with and without the cookie and I get the same response.
[ATTEMPT] target 220.127.116.11 - login "HELEN" - pass "pword" - 15 of 1000 [child 14] (0/0) [ATTEMPT] target 18.104.22.168 - login "SANDRA" - pass "pword" - 16 of 1000 [child 15] (0/0) [STATUS] 16.00 tries/min, 16 tries in 00:01h, 984 to do in 01:02h, 16 active [STATUS] 5.33 tries/min, 16 tries in 00:03h, 984 to do in 03:05h, 16 active [STATUS] 2.29 tries/min, 16 tries in 00:07h, 984 to do in 07:11h, 16 active [STATUS] 1.33 tries/min, 16 tries in 00:12h, 984 to do in 12:19h, 16 active
I realise if I change any part of the URL or IP address, there are no changes to the result, so I'm not sure if it is even connecting to the server.
I am using Kali linux, I uninstalled hydra and reinstalled the latest version from git.
I have tried on 3 different Internet connections.
Please could I have assistence in getting the command to not stall and process the wordlist.