Problem: Hydra keeps giving me incorrect passwords every time. I'm using brute-force via Hydra to guess the correct password on a certain website.
First of all I used BurpSuite to intercept the page request:
POST /abcdefg/ HTTP/1.1
Host: localhost:2000
User-Agent: Mozilla/5.0 (X11; Linux i686; rv:22.0) Gecko/20100101 Firefox/22.0 Iceweasel/22.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Referer: http://localhost:2000/abcdefg/ Connection: keep-alive Content-Type: application/x-www-form-urlencoded Content-Length: 23
usr=admin&pass=password
I am using these parameters for the command-line:
hydra -f -v -V 127.0.0.1 -s 2000 http-post-form -l admin -P /documents/pass.txt "/abcdefg/:pass=^PASS^:incorrect password"
- Host =
127.0.0.1( I know I can also try withlocalhost) - Port =
2000(My local computer is listening for HTTP at port 2000) - Method =
http-post-form - URL =
/abcdefg/ - Form parameters =
pass=^PASS^ - Failure response =
incorrect password. When I click submit, the page reloads with the same URL, but with only the text 'incorrect password' on screen. - User =
admin - Password file =
pass.txt
The page source of the login page:
<html>
<head>
<title>Login</title>
</head>
<form action="./" method="post">
username <input type="text" name="usr"></br>
password <input type="password" name="pass"></br>
<input type="submit" value="Submit">
</form>
</html>
The page source of the 'incorrect password' page:
<html>
<head>
<title>Login</title>
</head>
<br>incorrect password
Please take a look at all the parameters to make sure I am using the right commands.
I have also taken a look at this question: Why does Hydra return 16 valid passwords when none are valid? which suggests checking the page cookies, but the webpage I'm trying to brute force into does not use cookies, so I think that is irrelevant?
