Skip to main content
Share Your Experience: Take the 2024 Developer Survey

Questions tagged [hydra]

Hydra (THC Hydra) is a tool to automate brute force attacks against password authentication.

Filter by
Sorted by
Tagged with
0 votes
0 answers
24 views

How to correctly compose a command for brute force http-post-forms? [duplicate]

I encountered a strange error when using Hydra to brute force an http-post-form. Please tell me how to write a request correctly to avoid mistakes? hydra -L userslist -p passlist "url" http-...
DGDays's user avatar
  • 101
0 votes
0 answers
90 views

Hydra says different passwords with are correct each run, but only one works

I am doing CTF 'Skynet' from THM and came across this problem. Enumerating SMB, I gathered credentials 'milesdyson' and a list of passwords 'log1.txt'. I figured that I could try to brute force ...
Juan Vega Seco's user avatar
0 votes
0 answers
25 views

hydra returns all passwords tested as found [duplicate]

i have tried this command hydra localhost http-form-get "/DVWA-master/vulnerabilities/brute/?username=^USER^&password=^PASS^&Login=submit:F=incorrect:H=Cookie\:security=low; PHPSESSID=...
youssef blt's user avatar
2 votes
1 answer
557 views

Using Hydra on a NTLM authentication

I'm learning Active Directory attacks and in one of the labs we are given the example of gaining the initial foothold in an AD system via NetNTLM by performing a password spraying attack. For the ...
user2334659's user avatar
1 vote
0 answers
28 views

Hydra returning all credentials as valid [duplicate]

I am setting up a brute-force with hydra, and receiving valid responses for almost all requests from passwords list. But on the web form I am still getting an error that credentials are wrong. What am ...
SwissClaw's user avatar
-2 votes
1 answer
499 views

Every time this error coming why [closed]

sudo hydra -L /root/USERID.txt -p 'admin' 172.67.190.32 http-post-form '/https://serumcoin.net/signin:customerId=^USER^&password=^PASS^:Please check your customer Id and password combination' ...
Scott's user avatar
  • 1
1 vote
1 answer
9k views

Why hydra showing this error [ERROR] could not connect to ssh://192.168.0.1:22?

I am using hydra to bruteforce my router admin page. By scanning with nmap it is showing port 22 ssh is open and when i use medusa it is bruteforcing properly but with hydra i am using this command : ...
Cophmat's user avatar
  • 11
1 vote
0 answers
2k views

Hydra brute force ssh usernames with given RSA key

On a machine supporting ssh, an RSA key is given but no username. My idea was brute-forcing the SSH username with Hydra but I didn't find any option to give the RSA key to Hydra. Is it possible to ...
UndercoverDog's user avatar
2 votes
1 answer
3k views

Why does Hydra SMB attack not work while Metasploit does?

I'm learning about password attacks, and doing TryHackMe labs. User: penny Pass: leo1234 When using Hydra to find the password for the SMB user, I get no valid results: I know the valid password is ...
zeromeia's user avatar
1 vote
1 answer
2k views

Brute-Forcing DVWA login page with hydra - csrf incorrect

I'm learning how to use hydra, but I found a problem. When I run the following script, I get a CSRF token error. Apparently, the problem is that the token received in CURL is different from the one in ...
Laszlooo's user avatar
1 vote
0 answers
739 views

Brute forcing the brute force page on DVWA v1.0.7 using hydra

I am trying to brute force the brute force log-in page on DVWA v1.0.7 (/dvwa/vulnerabilities/brute/) I have been working on this for quite some time but I keep getting a bunch of false positives when ...
lexy Odiwe's user avatar
0 votes
0 answers
1k views

Hydra and Telnet bruteforcing

To preface this I have full permission to do anything I want to any service I can find on this network as it's part of a course I'm doing in Ethical Hacking. I also want to mention that I'm quite the ...
GooseLee33's user avatar
0 votes
0 answers
1k views

Hydra brute force not working for web app, but the correct password is in the list

I'm trying to brute force an Instagram account I created to play with Hydra. I ran the following command: Even though the correct password is in the list, it didn't work. This is the output I get: ...
Van1sh's user avatar
  • 1
1 vote
0 answers
1k views

hydra http-post-form specify multiple scenarios for failures

hydra -l ap.prpgramming -P ~/most-common-pass/best15.txt 203.xx.xx.xx http-post-form://203.xx.xx.xx:yy/wp-login.php:log=^USER^&pwd=^PASS^&wp-submit=Log+In&redirect_to=https://youtube.com/c/...
Adi Prasetyo's user avatar
0 votes
0 answers
14 views

How to pipe a character set on hydra [duplicate]

How to pipe a characterset to Hydra. Something like this which can be done on hashcat (crunch 8 8 123456789| hashcat -m 0 ce5cff0195a6b059a32411b6202ab49)
officialstar's user avatar
1 vote
1 answer
1k views

THC Hydra sends GET request without parameter before actual request with parameter which causes authentication problems

I am using THC Hydra (v9.0) on GNU/Linux to pentest my private API. The GET route in question requires a key as GET parameter which returns an auth token if the correct key was submitted else "...
sam's user avatar
  • 11
0 votes
2 answers
481 views

Using Hydra not sending traffic to target VM

I have 3 VM's 1 with Ubuntu server version 20.04, apache2, php, mysql and DVWA. (10.0.2.4) 1 with Ubuntu client version 20.04 with hydra installed. (10.0.2.5) 1 with Kali 2021.3. (10.0.2.6) All VM's ...
Rob The Ranger's user avatar
-2 votes
1 answer
986 views

hydra parse error [closed]

$ hydra 127.0.0.1 -l admin -P /usr/share/wordlists/rockyou.txt http-get-form “/dvwa/vulnerabilities/brute/?username=^USER^&password=^PASS^&Login=Login:Username and/or password incorrect.:H=...
Atiq 25462's user avatar
0 votes
0 answers
2k views

All passwords valid hydra

I was trying hydra out on DVWA login page, but it returned all 7 passwords correct, while only one was correct. Here is the command: hydra -l admin -P passlist.txt -V -I 192.168.70.130 http-post-form &...
Gl1tched's user avatar
0 votes
1 answer
10k views

Help with hydra https-post-form

I am doing portswigger labs with hydra https-post-form. I try to look for packets that don't have status code 200 OK, because when checked in burp my failed login with bad password and good username ...
Zorot's user avatar
  • 1
0 votes
1 answer
303 views

Prevent Hydra from URL encoding spaces

I'm having some problems with JSON requests in Hydra. I have a wordlist which consists of lots of lines; each with 2 words separated by a space. I run Hydra using the following command: sudo hydra -l &...
Maggie Ferguson's user avatar
0 votes
1 answer
2k views

Hydra hangs after TASKS number of tries

I have dvwa set up and i am using the command: hydra -IV -t 1 -l admin -P rockyou.txt localhost http-get-form "/vulnerabilities/brute/index.php:username=^USER^&password=^PASS^&Login=Login:...
John St's user avatar
0 votes
0 answers
58 views

Bypassing Hydra's 4 billion password limit [duplicate]

I'm trying to get into my friend's email (he is okay with it, we discussed it) and I'm using Hydra, but it has a limit to its bruteforcing that I can't seem to bypass, does anyone know how I can?
throwaway1337420's user avatar
1 vote
0 answers
420 views

Hydra attack ssh : The message is successful, but when using the errors

I execute the command hydra -l ubnt -p ubnt 138.255.252.193 -t 4 ssh I get the message it's successful Hydra (http://www.thc.org/thc-hydra) starting at 2021-02-22 11:32:05 [DATA] max 1 task per 1 ...
Touya Akira's user avatar
1 vote
2 answers
2k views

Brute Forcing DVWA with Hydra

I am attempting to brute-force 'DVWA/vulnerabilities/brute/' with Hydra, rockyou.txt password list. I tried using this command: hydra 127.0.0.1 -V -l admin -P rockyou.txt http-get-form "/DVWA/...
Dzomba's user avatar
  • 11
0 votes
1 answer
1k views

Hydra only executes one try per task then hangs

As in the title, hydra will only execute one try per task before hanging. $ hydra -l admin -P /usr/share/wordlists/wfuzz/general/common.txt -u 10.10.68.141 http-post-form "/admin:user=^USER^&...
not_only_but_also's user avatar
1 vote
1 answer
2k views

Run Hydra Through Series of Proxies?

Is there a way to run Hydra through a series of proxies so a website can't lock you out? Having a hard time finding a way to do this. Most websites will block you out if you take to many attempts at ...
love2phish's user avatar
0 votes
2 answers
688 views

password brute force over ssh? (not on ssh)

Can Hydra ssh to remote host and attempt a password list against su root? I am trying to recover the root password to an old device. It is an old Apple jailbroken Apple device, running IOS8. The ...
gcb's user avatar
  • 233
3 votes
1 answer
3k views

Hydra http-post-form based on length of the response

Is there any way for hydra to understand the correct combination ^USER^ and ^PASS^ in a http-post-form authentication attack based on the length of the body response? In Burpsuite you can look at the ...
Riccardo D's user avatar
0 votes
1 answer
578 views

Hydra brute-force login with a timestamp

I am attempting to run a brute-force attack on my router just as a proof of concept and have hit a problem in that the POST request requires a parameter of the current timestamp. Here is my current ...
adammoyle's user avatar
  • 103
0 votes
1 answer
647 views

wfuzz default number of connects in parallel per target?

In Hydra, default number of connects in parallel per target is 16 and it can be changed with -t flag. E.g. -t 100 for 100 connection in parallel per target. wolf@linux:~$ hydra -h | grep parallel -...
Wolf's user avatar
  • 367
0 votes
1 answer
2k views

How to reduce false positive in hydra http-post-form module due to more than 1 error?

This question is based on security challenge on Basic Pentesting: 1. Feel free to download if you want to reproduce this issue as well. It's easy to do this if there's only a single error message ...
Wolf's user avatar
  • 367
0 votes
1 answer
5k views

Bruteforce all IP addresses on network with Hydra

I have been tasked to pen test a computer on my network. I have done some social engineering to get the username and password of the device, and I know ssh is open on the computer. However, I do not ...
c0mraide's user avatar
0 votes
0 answers
1k views

HTC Hydra does not show the password and username obtained

I am doing a practice with Hydra in Kali Linux 2020. The problem i have is that when finish the process and obtain a correct password, it does not show me the password obtained, what it does show is ...
elun's user avatar
  • 9
0 votes
0 answers
56 views

Hydra THC - Get failed login [duplicate]

I'm trying to get a password from a website (From my account, I know the password) using Hydra. The problem: I can't find any usable feedback from the website telling Hydra if the password is wrong or ...
robiii's user avatar
  • 1
1 vote
1 answer
3k views

Hydra hangs after attempts or returns all passwords valid

I'm using the Hydra tool on Kali Linux 2020.1 and I'm trying to brute force a login at hack.me http://s123056-104737-qer.sipontum.hack.me/login.php. My problem is that whenever I run Hydra it gets ...
Nicholas Obert's user avatar
0 votes
0 answers
512 views

Input multiple password files

I have a number of relatively small password files that I'd like to use with Hydra in one go without having to manually merge them but it seems that it doesn't natively support this or stdin. From ...
mythofechelon's user avatar
1 vote
1 answer
3k views

Hydra HTTP Form Post with parameters containing a colon ":"

I'm trying to brute force login on my domain using THC Hydra v9.1-dev. It is using an ASP.net form and some of the required post body parameters contain a colon : in them which is the separator used ...
mahmoudafer's user avatar
1 vote
0 answers
958 views

Hydra - Brute force command is stalling

Very new to application testing here. I am working through the hacker101 CTF (petshop) examples and I am having problems with brute forcing a username form with Hydra. The error message looks like it ...
konk's user avatar
  • 11
0 votes
1 answer
196 views

John stdout to Hydra

I'm trying to use a John ruleset which seems to take up more space than I have available. Is there a way to pipe John into Hydra?
Jacob Cross's user avatar
0 votes
1 answer
170 views

differentiate correct and incorrect password [closed]

So here it is, I had time to kill, so I used it to hack into my own gmail address with THC Hydra. (very fun I know). So I checked out some old forums and gradually learned how to do it. I understood ...
CaporalReiss's user avatar
1 vote
1 answer
352 views

Hydra ( Host Offline redoing attempt)

I tried to brute force a http-get service using -M option with list of servers of which some host are down/offline. However when hydra reaches to offline host it tries to redo-attempt many times on ...
user180053's user avatar
0 votes
1 answer
6k views

Hydra too slow - Counter BruteForce protection? [closed]

I'm trying to bruteforce with Hydra (I'm a newbie). But it takes too much time, only 15 attempts in 30 minutes for example... I tried to inform myself about this problem, and it seems to be slow ...
Kenichi-san's user avatar
1 vote
0 answers
360 views

Hydra gives different password each time (DVWA)

I've looked up this issue and everyone's problem was they didn't have the failed login string. I do. Trying to get into DVWA. Here's my command hydra 10.0.250.143 -l admin -P P.txt http-get-form "/...
NerdyKid1101's user avatar
1 vote
2 answers
4k views

How to brute force only username not password?

I want to find the username first, then pass the username and a password list. I could not find flags to ignore password in Ncrack and other related tools. The device I want to find a username is ...
tyler durden's user avatar
2 votes
2 answers
5k views

Using Hydra with JSON

Trying for the life of me to get Hydra to work with a JSON request. General: Request URL: https://api.myapp.app/api/accounts/login/ Request Method: POST Status Code: 401 Unauthorized Remote Address:...
pieman15's user avatar
0 votes
1 answer
3k views

Using THC Hydra to attack Cisco router

I am trying to do successfull attack on my cisco home router using THC Hydra. I already know a username/password(admin/admin). First with nmap I looked for open ports on router and only opened one ...
sha256's user avatar
  • 1
2 votes
1 answer
757 views

Is Hydra splitting the wordlist file into as many parts as tasks / threads?

I'm playing around with Hydra and an xmpp authentication. I created a basic xmpp server of my own, reproducing an authentication (server side) from a clear text pcap file. I think I got something ...
T. Rode's user avatar
  • 91
1 vote
2 answers
9k views

Brute-Forcing DVWA login page with hydra

I'm learning how to brute force web login pages with a popular brute force tool called "Hydra". I'm using Kali Linux (VirtualBox) to do this. I've installed DVWA (Damn Vulnerable Web Application) and ...
CoderPE's user avatar
  • 11
0 votes
1 answer
6k views

THC Hydra on Windows RDP Domain

I am testing a bruteforce on a windows rdp server within a domain. It seems to not be working because nothing is locking out the account I am targeting. How do you specify a domain username? I tried ...
john_zombie's user avatar