I've been trying to use hydra (educational way) but with no success. The site method is http-post but performed by ajax (should it be a problem? I think not). After execute the command I got an output of passwords and username that allegedly valid. I saw that some people have asked about the reason for hydra giving wrong passwords and usernames and the answer was that the command should include the PHPSESSID. So I've been trying to use PHPSESSID but nothing changes.

the command:

hydra -L id.txt -P id.txt -s 80 -f http-post-form "/Login/ajax/user-login.php:data=username=^USER^&password=^Pass^&remember=off&returnpath=:Fail :H=Cookie: security=low;PHPSESSID=9adriqaprd8f1qgot3ia1k3"

Any suggestions for the wrong passwords?

  • You need more information about the page you're attacking. Try a manual test with curl or so, and see if the page actually sends "Fail " (with space) back to you, which is what you are searching for. – ndrix Feb 20 '14 at 12:41
  • Are you trying that on Damn Vulnerable Web Application (DVWA) ? – ack__ Feb 21 '14 at 12:41
  • First of all, thanks for reply. -It doesn't send fail at all. -No, I'm using kali-linux. – user40118 Feb 21 '14 at 15:17

The way that Hydra determines if an attempt was successful or not is by comparing strings found in successful and unsuccessful return pages.

in your scenario i am assuming that the application is returning Fail if the attempt is not successful and something else if it is. if the page is blank in both cases that means all the attempts will be considered successful.

you should find a unique string in the return page (or page source) and put it after the :

more information here


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.