Skip to main content

Questions tagged [http-brute]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
1 vote
0 answers

Hydra returning all credentials as valid [duplicate]

I am setting up a brute-force with hydra, and receiving valid responses for almost all requests from passwords list. But on the web form I am still getting an error that credentials are wrong. What am ...
SwissClaw's user avatar
0 votes
1 answer

Help with hydra https-post-form

I am doing portswigger labs with hydra https-post-form. I try to look for packets that don't have status code 200 OK, because when checked in burp my failed login with bad password and good username ...
Zorot's user avatar
  • 1
1 vote
1 answer

Suspiscious HTTP request to nginx server in server log, what is it?

I have an nginx server running an instance of and express/nodejs server. I was going through the logs to see what was being requested, and I noticed a few normal attempts for common flaws in things ...
David Kamer's user avatar
1 vote
1 answer

Hydra: Brute force an http form, all arguments are supplied but the login error has other string formats and is too big

I am using Hydra to brute force a login http form (Method: post), but I'm getting false positives (passwords that aren't valid) I believe I know the reason, I just don't know how to handle it: The ...
coredumped0x's user avatar
4 votes
1 answer

Wireshark HTTP continuations (Hydra HTTP version)

I am trying to use Hydra to brute force a HTTP POST form page, however the page is returning a HTTP Continuation I'm not sure what that is. This is being caused by the HTTP/1.0 at the top of the ...
sunny-lan's user avatar
  • 251
1 vote
1 answer

How to brute force HTTP Basic Authentication requested with XHR?

How can one brute force a website using HTTP Basic authentication using metasploit which uses XHR in background? I am getting error "No URI found that asks for HTTP authentication". Relevant headers ...
Krishna Pandey's user avatar
1 vote
3 answers

Nmap http-brute - Supplying arguments for bruting via GET

I'm attempting to brute a site in my test lab with Nmap's http-brute nse, which has the URL structure[email protected]&password=pass Unfortunately Nmap's official ...
16b7195abb140a3929bbc322d1c6f1's user avatar