Problem: Hydra keeps giving me incorrect passwords every time. I'm using brute-force via Hydra to guess the correct password on a certain website.
First of all I used BurpSuite to intercept the page request:
POST /abcdefg/ HTTP/1.1 Host: localhost:2000 User-Agent: Mozilla/5.0 (X11; Linux i686; rv:22.0) Gecko/20100101 Firefox/22.0 Iceweasel/22.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Referer: http://localhost:2000/abcdefg/ Connection: keep-alive Content-Type: application/x-www-form-urlencoded Content-Length: 23 usr=admin&pass=password
I am using these parameters for the command-line:
hydra -f -v -V 127.0.0.1 -s 2000 http-post-form -l admin -P /documents/pass.txt "/abcdefg/:pass=^PASS^:incorrect password"
- Host =
127.0.0.1( I know I can also try with
- Port =
2000(My local computer is listening for HTTP at port 2000)
- Method =
- URL =
- Form parameters =
- Failure response =
incorrect password. When I click submit, the page reloads with the same URL, but with only the text 'incorrect password' on screen.
- User =
- Password file =
The page source of the login page:
<html> <head> <title>Login</title> </head> <form action="./" method="post"> username <input type="text" name="usr"></br> password <input type="password" name="pass"></br> <input type="submit" value="Submit"> </form> </html>
The page source of the 'incorrect password' page:
<html> <head> <title>Login</title> </head> <br>incorrect password
Please take a look at all the parameters to make sure I am using the right commands.