I'm trying to brute force login on my domain using THC Hydra v9.1-dev. It is using an ASP.net
form and some of the required post body parameters contain a colon :
in them which is the separator used by Hydra. An example parameter: _ctl0:PlaceHolder:LoginName:txtLoginUsername=^USER^
.
This makes hydra think that I have _ctl0
as the first part and Placeholder
as the error message.
I tried:
URL encoding
them, e.g this becomes:_ctl0%3APlaceHolder%3ALoginName%3AtxtLoginUsername=^USER^
- placing the parameter in quotation marks
""
but none of them worked and I can't seem to find a way to change the separator.
Any help is much appreciated!