1

I am using THC Hydra (v9.0) on GNU/Linux to pentest my private API.

The GET route in question requires a key as GET parameter which returns an auth token if the correct key was submitted else "false".
If no key or a wrong key is submitted, the route returns always "false" for the next 5 seconds, even if the correct key is submitted.

(Please do not comment the way the API works, this is not the question)

Problem:
Even when providing the correct key to Hydra, it returns "false". When executing Hydra with -d it shows me that before the actual request with the key as parameter is sent, it sends a request without any parameters.

Question:
Why does Hydra do this and can I prevent it?

This cannot be due to the HTTP request because with other tools like curl or Postman, it immediately sends the request with the parameter.

4
  • See this post.
    – user
    Sep 29, 2021 at 15:14
  • There appears to be an option to disable that function in hydra-http-form.c ((g|G)= skip pre-requests - only use this when no pre-cookies are required). If that's the module you're using you may have luck with that option.
    – user
    Sep 29, 2021 at 15:23
  • @user Please don't post answers as comments.
    – user163495
    Sep 29, 2021 at 18:33
  • @MechMK1 I do not have THC Hydra, so I don't know if that even answers the question.
    – user
    Sep 29, 2021 at 19:06

1 Answer 1

0

Like @user said in the comments, Hydra does this pre request to get the inital cookies of the webpage.

You can set another webpage for the pre-request with c= as optional parameter after the check condition like so:
hydra -l user -p pass 127.0.0.1 http-get-form "/api/route/:password=^PASS^:false:c="

This way hydra does not use the actual route to fetch the cookies and my problem is solved.

0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .