I have never experimented much with online password crackers. I attempted to use Hydra today on this website www.athena2.harker.org and I keep getting false positives.
This is what I have done so far:
- pinged the website and obtained the IP address of 18.104.22.168
identified the form type, its an https-form-post
<form id="login" method="post" action="https://athena2.harker.org/login/index.php">
found the failure response: it's “Invalid login, please try again”
run this command
hydra 22.214.171.124 https-form-post "/login/index.php:username=^USER^&password=^PASS^&Login=Login:Invalid login" -l test -p test -t 10 -w 30 -o example.txt
Can someone tell me what I am doing wrong?
I work in IT for the school. We operate on the open source Moodle platform, and a student recently obtained administrator access, we are evaluating the strength of the passwords we issue. (6 digit/lowercase letter password). Don't assume people on this forum attack targets maliciously, penetration testing and computer security are legitimate fields, I thought everyone here would be aware of that.