3

How do I have to use hydra on a web form?

What I have done so far:
I already successfully used hydra on a folder with an HTTP authentication:

http://localhost/test/authtest/

with user admin and password 1234, I successfully found out the password with:

hydra -l admin -x 1:5:1 -t 1 -f -vV 127.0.0.1 http-get /test/authtest/

But how would I have to try a run on a web form like

http://127.0.0.1/test/login.php?&username=admin&password=1234
Improve this question
0

1 Answer 1

Reset to default
6

Basically, you need to specify two things:

  1. Where the username and password go.
  2. How to determine success/failure of the request.

The first is accomplished with tokens like ^USER^ and ^PASS^ in the URL where they are to be replaced by the usernames and passwords under test. The second is done by hydra by string matching against the returned page. You can either test for a failure condition, such as "Bad password", or a success condition, such as "logged in".

Here's an example:

hydra 127.0.0.1 http-form-get '/test/login.php?username=^USER^&password=^PASS^:Bad password'

You can also test for a cookie being set with C=cookie_name or an HTTP header with H=header_name in place of "Bad password" for the test condition for a successful login.

In case the login form uses POST, rather than GET, (as many do) you should use the http-form-post "protocol". You'll also need to use : to separate the URL and the POST parameters, rather than the ? in a query string. There's also https variations, which are (unsurprisingly) prefixed with https-, rather than http-.

Improve this answer
9
  • I get an error when I try this: hydra -l admin -x 1:8:1 -t 1 -f -vV 127.0.0.1 http-form-post '/login.php?username=^USER^&password=^PASS^:Bad password' The Error is: [ERROR] the variables argument needs at least the strings ^USER^ or ^PASS^: Bad password
    – rubo77
    Jun 11, 2014 at 6:29
  • Modified to clarify the answer, but TL;DR is separate post variables with a :. For example 'login.php:username=^USER^&password=^PASS^:Bad password'.
    – David
    Jun 11, 2014 at 6:33
  • Thanks that worked, maybe you add my example for a post form and auto generation of passwords from 0 up to 99999999 to your post
    – rubo77
    Jun 11, 2014 at 6:35
  • I am getting false positives. I guess due to the fast rate of requests sometimes my server doesn't deliver the whole page and the part with "Bad password" is missing, so hydra thinks the password worked. Shouldn't hydra verify the password before stopping?
    – rubo77
    Jun 11, 2014 at 7:54
  • Consider using "S=Good Password" instead, so it will look for an affirmative response. Though then you might get false negatives if an error occurs on a valid password.
    – David
    Jun 11, 2014 at 14:20

Not the answer you're looking for? Browse other questions tagged .