I have programmed a log in in my webpage and now I want to test it against a dictionary attack. I am using Apache and my website is not online so to access it I connect to localhost/website In hydra I am using the command

hydra -l username -P passList.txt localhost/website http-post-form "/logIn.php:user=^USER^&pass=^PASS:forgot"

But it terminates with error

[DATA] attacking service http-post-form on port 80 [ERROR] could not resolve address: localhost/website 0 of 1 target completed, 0 valid passwords found [ERROR] 1 target did not resolve or could not be connected

What could be the problem?

  • There are a number of places to look for the answer that might give you clues as to what is going wrong. What happens if you visit localhost/website in your browser? Can you ping it? Have you tried using Have you tried looking at hydra -h more closely? Check /etc/hosts. – Ian Jan 20 '15 at 11:33

It looks like the problem is here localhost/website This command should do the trick hydra localhost http-post-form "/logIn.php:user=^USER^&pass=^PASS:forgot" -l username -P passList.txt

  • or "/website/logIn.php", depending on the path. – Michael Jan 20 '15 at 12:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.