This question already has an answer here:

I had asked this question in the general forum I think it is more adequate to place it here.

https://stackoverflow.com/questions/27606232/hydra-from-kali-linux-tamper-http-post-form-syntax-of-the-failure-login-attemp

Here it is the complete description:

I am doing a pentest of an internal site, I would like to check how secure is this when using Hydra from (Kali) Linux as the password cracking tool.

I have used the mozilla Tamper add on to get the head options ( I think I do not have the correct ones)

What I tried is: user=tech15 (technical user, users are known) List of passwords where only ONE is the correct one = fakelist.txt

hydra -l tech15 -P fakelist.txt -vV www.mysite.com http-post-form "/members-login.php=:user^USER^&pass=^PASS^:S="

The string "/auth/ajax-login-frame.php?ajax-login-frame-id=register-or-login-overlay-ajax-login-frame&usernameAttempt=tech15" is the failure page, when password is not correct and it tells you the user has tried to login.

When succesfully login, the page is redirecting to another page.

"/members-login.php" is the webpage

and the tamper just provided me with the following string, where the last part of the user attemt is not written

"/auth/ajax-login-frame.php?ajax-login-frame-id=register-or-login-overlay-ajax-login-frame"

I wonder if the information from tamper I have collected is correct, or I need to look after again. Could you please help me to understand how to describe properly the syntax for the succesful login.

When executing the commands in hydra all passwords from the list (99 passwords) are valid, which is not correct and only ONE is the valid one.

[80][www-form] host: ip.number.X.XX  login: tech15   password: notcorrect
[STATUS] attack finished for www.mysite.com (waiting for
children to complete tests)
1 of 1 target successfully completed, 99 valid passwords found

Could you please take a look and point me in the proper direction Is there any documentation for Hydra?

Regards.

New EDIT ---- 22-12-2014 ----

It is still not solved, but I think I have not the correct information

These are the chains I have at the moment.

When Failing

http://www.mysite.com/auth/ajax-login-frame.php?ajax-login-frame-id=register-or-login-overlay-ajax-login-frame&usernameAttempt=tech15

When Succesfull

http://www.mysite.com/auth/ajax-login-success.php?ajax-login-frame-id=register-or-login-overlay-ajax-login-frame

Cookie=PHPSESSID=9c77p1nhj530mpj4apun1mjv71;

But I still get all 99 paswords as valid ones.

Thanks,

marked as duplicate by schroeder, Xander, TildalWave, Jens Erat, RoraΖ Jan 23 '15 at 12:21

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • 1
    It's better to either give us the full question here, or go to Stack Overflow and flag your question for moderator attention, asking to migrate it. With respect to documentation, requests for off-site resources are usually off-topic on Stack Exchange. – S.L. Barth Dec 23 '14 at 14:51
  • Have you tried typing man hydra? – SilverlightFox Dec 23 '14 at 20:28
  • Yes, it is not explaining the failure syntax – ORP Dec 23 '14 at 21:13
  • 1
    With Fiddler, check what comes back when doing a successful login, and compare it to what comes back when doing an unsuccessful one. Fill in the difference as a S= or F= parameter. Also check the headers and use the H= parameter to reproduce them. If it is still failing youll have to compare a web app resuest to a hydra request with Wireshark. – Michael Dec 24 '14 at 6:36
  • It is long winded as man hydra indicates that you can use hydra -h for help, then the output from this shows you can get specific module help with -U including failure syntax: hydra -U http-post-form. – SilverlightFox Dec 24 '14 at 11:08

Manual:

  • -v -V: be verbose
  • -L: user list
  • -P: password list
  • -l: username
  • -p: password
  • -s: server + port
  • “1:2:3:4”: 1=page, 2=body content, 3=failure (F=) or success (S=) message, 4: H= headers can be specified (optional). In headers, you do not have to escape the colon.

So, what you should do is add something next to the S= you have there. That something should be a word that appears in the page to which your site is redirecting after successful login (e.g. success, welcome, etc.). Something like this:

hydra -l tech15 -P fakelist.txt -vV www.mysite.com http-post-form "/members-login.php=:user^USER^&pass=^PASS^:S=Welcome"

Of course, if you have a specific failure page (e.g. "login failed"), you could just replace the S= with F= and add "F=failed"

Not the answer you're looking for? Browse other questions tagged or ask your own question.