Problem: Hydra keeps giving me incorrect passwords every time. I'm using brute-force via Hydra to guess the correct password on a certain website.
First of all I used BurpSuite to intercept the page request:
POST /abcdefg/ HTTP/1.1 Host: localhost:2000 User-Agent: Mozilla/5.0 (X11; Linux i686; rv:22.0) Gecko/20100101 Firefox/22.0 Iceweasel/22.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Referer: http://localhost:2000/abcdefg/ Connection: keep-alive Content-Type: application/x-www-form-urlencoded Content-Length: 23 usr=admin&pass=password
I am using these parameters for the command-line:
hydra -f -v -V 127.0.0.1 -s 2000 http-post-form -l admin -P /documents/pass.txt "/abcdefg/:pass=^PASS^:incorrect password"
- Host = 127.0.0.1 ( I know I can also try with localhost)
- Port = 2000 (My local computer is listening for HTTP at port 2000)
- Method = http-post-form
- URL = /abcdefg/
- Form parameters = pass=^PASS^
- Failure response = incorrect password. When I click submit, the page reloads with the same URL, but with only the text 'incorrect password' on screen.
- User = admin
- Password file = pass.txt
The page source of the login page:
<html> <head> <title>Login</title> </head> <form action="./" method="post"> username <input type="text" name="usr"></br> password <input type="password" name="pass"></br> <input type="submit" value="Submit"> </form> </html>
The page source of the 'incorrect password' page:
<html> <head> <title>Login</title> </head> <br>incorrect password
I am just starting off penetration testing so it would be cool if you guys can help me out, I might be missing obvious details :) Thanks in advance!