0

This question already has an answer here:

So when I do hydra -l Admin -P "rockyou.txt" -s 80 192.168.13.1 http-get / it doesn't work for me. It says all 16 passwords are valid, but none of them works. Can anyone help me with this? I tried googling and found others having this issue, but none of them were descriptive enough for me to resolve this. I'm using a D-Link DIR 655 router, and that's what I want to try to bruteforce, but all the passwords it tries are valid (16 for that matter).

|improve this question

marked as duplicate by Xander, schroeder♦, TildalWave, Gilles, Graham Hill Sep 17 '14 at 10:26

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • If you are using the same "rockyou.txt" that I do, it contains over 14 million passwords, if you are only seeing 16 results then something is wrong. – Red_Shadow Aug 13 '14 at 18:46
  • Well its like so cause i saw someone saying that THC Hydra didnt find the Login and Password field where to try the brute force on, therefor it didnt get a fail response and said all passwords are correct, any idea? – Yannic Schwarz Aug 14 '14 at 20:18
2

I tried Hydra on an HTTP-POST web form and I kept getting false positives. After a lot of research and googling tutorials it turns out I did not identify the "failure response". When the login fails, the server replies with a failure response maybe a redirection or a string of text. I hope this points you in the right direction.

|improve this answer
  • The failure condition is the one thing most people forget to do for Hydra. – schroeder♦ Sep 16 '14 at 18:29

Not the answer you're looking for? Browse other questions tagged or ask your own question.