Skip to main content

Questions tagged [http-brute]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
1 vote
0 answers
28 views

Hydra returning all credentials as valid [duplicate]

I am setting up a brute-force with hydra, and receiving valid responses for almost all requests from passwords list. But on the web form I am still getting an error that credentials are wrong. What am ...
0 votes
1 answer
11k views

Help with hydra https-post-form

I am doing portswigger labs with hydra https-post-form. I try to look for packets that don't have status code 200 OK, because when checked in burp my failed login with bad password and good username ...
1 vote
3 answers
11k views

Nmap http-brute - Supplying arguments for bruting via GET

I'm attempting to brute a site in my test lab with Nmap's http-brute nse, which has the URL structure https://192.168.101.6/api/[email protected]&password=pass Unfortunately Nmap's official ...
1 vote
1 answer
393 views

Suspiscious HTTP request to nginx server in server log, what is it?

I have an nginx server running an instance of and express/nodejs server. I was going through the logs to see what was being requested, and I noticed a few normal attempts for common flaws in things ...
1 vote
1 answer
6k views

Hydra: Brute force an http form, all arguments are supplied but the login error has other string formats and is too big

I am using Hydra to brute force a login http form (Method: post), but I'm getting false positives (passwords that aren't valid) I believe I know the reason, I just don't know how to handle it: The ...
4 votes
1 answer
2k views

Wireshark HTTP continuations (Hydra HTTP version)

I am trying to use Hydra to brute force a HTTP POST form page, however the page is returning a HTTP Continuation I'm not sure what that is. This is being caused by the HTTP/1.0 at the top of the ...
1 vote
1 answer
4k views

How to brute force HTTP Basic Authentication requested with XHR?

How can one brute force a website using HTTP Basic authentication using metasploit which uses XHR in background? I am getting error "No URI found that asks for HTTP authentication". Relevant headers ...