Questions tagged [hydra]
Hydra (THC Hydra) is a tool to automate brute force attacks against password authentication.
90
questions
0
votes
1answer
54 views
Hydra hangs after attempts or returns all passwords valid
I'm using the Hydra tool on Kali Linux 2020.1 and I'm trying to brute force a login at hack.me http://s123056-104737-qer.sipontum.hack.me/login.php.
My problem is that whenever I run Hydra it gets ...
0
votes
0answers
27 views
Input multiple password files
I have a number of relatively small password files that I'd like to use with Hydra in one go without having to manually merge them but it seems that it doesn't natively support this or stdin.
From ...
2
votes
1answer
96 views
Hydra HTTP Form Post with parameters containing a colon “:”
I'm trying to brute force login on my domain using THC Hydra v9.1-dev. It is using an ASP.net form and some of the required post body parameters contain a colon : in them which is the separator used ...
0
votes
0answers
121 views
Hydra - Brute force command is stalling
Very new to application testing here. I am working through the hacker101 CTF (petshop) examples and I am having problems with brute forcing a username form with Hydra. The error message looks like it ...
0
votes
1answer
66 views
John stdout to Hydra
I'm trying to use a John ruleset which seems to take up more space than I have available. Is there a way to pipe John into Hydra?
0
votes
1answer
79 views
differentiate correct and incorrect password [closed]
So here it is, I had time to kill, so I used it to hack into my own gmail address with THC Hydra. (very fun I know).
So I checked out some old forums and gradually learned how to do it.
I understood ...
0
votes
0answers
59 views
Hydra ( Host Offline redoing attempt)
I tried to brute force a http-get service using -M option with list of servers of which some host are down/offline.
However when hydra reaches to offline host it tries to redo-attempt many times on ...
-1
votes
1answer
248 views
Hydra too slow - Counter BruteForce protection? [closed]
I'm trying to bruteforce with Hydra (I'm a newbie).
But it takes too much time, only 15 attempts in 30 minutes for example...
I tried to inform myself about this problem, and it seems to be slow ...
1
vote
0answers
71 views
Hydra gives different password each time (DVWA)
I've looked up this issue and everyone's problem was they didn't have the failed login string. I do. Trying to get into DVWA.
Here's my command
hydra 10.0.250.143 -l admin -P P.txt http-get-form "/...
0
votes
0answers
119 views
Where are Advanced Hydra Options for http-form-post Documented?
I'm trying to brute force a login page (checklogin.htm) that returns a blank response in the event of a failed login, instead it forcing a browser redirect to a different page (login.htm), passing a ...
0
votes
0answers
49 views
What's the proper way to identify string values in hydra http post form
I've seen plenty of posts regarding the syntax for setting http post form's when using hydra and all of them just show username and password as being the only two keys when making a login post request....
0
votes
2answers
519 views
How to brute force only username not password?
I want to find the username first, then pass the username and a password list. I could not find flags to ignore password in Ncrack and other related tools. The device I want to find a username is ...
0
votes
0answers
155 views
Using Hydra with JSON
My question is simply a follow up question to these two similar threads:
Bruteforce - Using Hydra with JSON
How to run Hydra with json response?
My question is: What if the JSON file has this text ...
1
vote
2answers
861 views
Bruteforce - Using Hydra with JSON
Trying for the life of me to get Hydra to work with a JSON request.
General:
Request URL: https://api.myapp.app/api/accounts/login/
Request Method: POST
Status Code: 401 Unauthorized
Remote Address:...
0
votes
1answer
866 views
Using THC Hydra to attack Cisco router
I am trying to do successfull attack on my cisco home router using THC Hydra. I already know a username/password(admin/admin).
First with nmap I looked for open ports on router and only opened one ...
2
votes
1answer
163 views
Is Hydra splitting the wordlist file into as many parts as tasks / threads?
I'm playing around with Hydra and an xmpp authentication.
I created a basic xmpp server of my own, reproducing an authentication (server side) from a clear text pcap file.
I think I got something ...
1
vote
1answer
2k views
Brute-Forcing DVWA login page with hydra
I'm learning how to brute force web login pages with a popular brute force tool called "Hydra". I'm using Kali Linux (VirtualBox) to do this. I've installed DVWA (Damn Vulnerable Web Application) and ...
0
votes
1answer
3k views
THC Hydra on Windows RDP Domain
I am testing a bruteforce on a windows rdp server within a domain. It seems to not be working because nothing is locking out the account I am targeting. How do you specify a domain username? I tried ...
1
vote
2answers
759 views
Finding and attacking an IMAP Server
For a security challenge I am supposed to dictionary attack an IMAP service. A rather simple exercise using hydra.
So far I failed, since I've given hydra the actual website instead of the mail ...
1
vote
1answer
116 views
Online brute force attack which will continue in background [closed]
I don't have enough bandwidth for brute force dictionary attacks so I'm searching for a website or a way that I can do brute force attacks as a background process even if I turn my internet ...
3
votes
2answers
776 views
Hydra gives right password if used after 3 minutes else gives wrong passwords
I have a D-Link DCS 5222LB IP camera. I am trying to bruteforce the IP camera. The camera uses basic HTTP authentication. I use the following command:
hydra -l admin -P passlist.txt -t 3 http://...
2
votes
1answer
229 views
How to interpret the attempt information from Hydra
I was performing a Hydra attack on my TP-Link router and for that I prepared a passwords.txt file with 288 passwords.
hydra -l webadmin -P test_creds/passwords.txt xxx.xxx.xxx.xxx ftp
A minute ...
1
vote
1answer
187 views
Hydra not matching password provided in file
I was pen-testing my TP-Link router yesterday and tried performing a Hydra attack on it. I wrote the following line on the terminal:
hydra -l admin -p passwords.txt 192.168.0.1 http
The username and ...
2
votes
1answer
2k views
Brute Force Post via Hydra
I am trying to brute force an HTTP login form via Hydra.
The problem I am having is in regards to the response code returned by the page. I am receiving false positives on every password.
Even ...
1
vote
1answer
554 views
Is it possible to specify multiple values for failure condition (F=) using Hydra?
I want to brute-force a site using Hydra (https-post-form) that I don't know valid login credentials for, so I cannot specify a value for success condition (S=).
Failed logins result in a redirect ...
1
vote
1answer
829 views
Hydra: Brute force an http form, all arguments are supplied but the login error has other string formats and is too big
I am using Hydra to brute force a login http form (Method: post), but I'm getting false positives (passwords that aren't valid)
I believe I know the reason, I just don't know how to handle it:
The ...
1
vote
1answer
525 views
How can i fine tune hydra to find the correct password
I am having a bit of a pickle getting hydra to see the correct password when the page is redirected. The condition where the password is correct is if the login is redirected to a certain page in the ...
1
vote
0answers
242 views
Unable to display login username in Hydra
So I'm performing an authentication cracking lab using Hydra, I use the following command;
hydra -L /usr/share/ncrack/minimal.usr -P /usr/share/wordlists/s1.txt -f -V 192.168.99.22 telnet
The ...
4
votes
1answer
473 views
Hydra - Attacking when login page encodes the username and password
I needed to test how Hydra works, so I tried to attack my own wifi router. I set the user name as "user" and created a txt file containing 100 passwords including the "real" password.
I am unable to ...
0
votes
1answer
6k views
Simple Hydra test with Windows RDP
I am using VMware and have 3 VMs all on the NAT network with DHCP. All three machines can ping each other. From one windows to the other windows, I can RDP into the 192.168.190.130 windows machine ...
1
vote
2answers
904 views
Piping crunch into hydra
Is it possible to pipe the output from crunch into hydra ?
I tried this, but it doesn't work:
crunch 1 6 123456 --stdout | hydra -S -l ---------@gmail.com -v -V -e nsr -s 465 smtp.gmail.com smtp
0
votes
1answer
2k views
Hydra brute force error message
hydra 190.13.132.90 -s 8081 -V -L /home/nicolas/Escritorio/USER -P /home/nicolas/Escritorio/passwords.txt http-post-form "/user=^USER^&password=^PASS^=Ingresar&culture=es-CL&mobile=0&...
4
votes
1answer
396 views
Hydra - all passwords work
I want to test some mechanisms of my website when the password of a single user is entered a lot of times in a short time incorrectly in the login form.
Therefore I got Hydra (for windows) on GitHub.
...
0
votes
2answers
5k views
Hydra fails with “[ERROR] target ssh://192.168.16.128:22/ does not support password authentication.”?
I've updated Kali 2.0 to newest version - it is installed using VMWare.
Now, every time I use hydra to brute-force SSH, I get the following error:
[ERROR] target ssh://192.168.16.128:22/ does not ...
1
vote
0answers
179 views
Using hydra on a website that has the same response for both a wrong and correct password
I got my hands on an old-ish residential gateway with SIP support and two analog phone connections. I want to use it for it's SIP support to use analog phones with my SIP provider. I didn't know the ...
-2
votes
1answer
1k views
Hydra shows 1 valid password found but shows password as wordlist location [closed]
When I use hydra to crack a router's password, it shows that 1 valid password found but shows the location of my wordlist as the password.
That IP is not mine, I got it from shodan.io. I wanted to ...
1
vote
0answers
388 views
THC Hydra false positives on Foscam login
I bought a Foscam C1 Lite this week and I want to try to brute force the login page with THC hydra.
But currently I am getting false positives with the following command:
hydra -s 88 -l user -P ...
2
votes
1answer
301 views
What's the fastest protocol to target for password attacks
In a Windows domain environment, there are numerous protocols (SMB, LDAP, Webpages, RDP, FTP, etc.) that query against the same Windows based AD. Many of these protocols have their own overhead that ...
-4
votes
1answer
2k views
Hydra brute-force not working [closed]
This is the command I am using and when I press Enter :
hydra -L username.txt -P passwords.txt localhost http-post-form "dvwa/login.php:username=^USER^&password=^PASS^&Login="Login Failed"
>
...
4
votes
1answer
530 views
Wireshark HTTP continuations (Hydra HTTP version)
I am trying to use Hydra to brute force a HTTP POST form page, however the page is returning a HTTP Continuation I'm not sure what that is.
This is being caused by the HTTP/1.0 at the top of the ...
0
votes
1answer
3k views
Getting [ERROR] Invalid target definition! while specifying https://mysitename.com in Hydra Gtk
In Hydra-GTK, I've specified my target name as https://example.com (it's not www) and mentioned protocol as https-post-form and then entered username and password list and then I started.
But I got ...
2
votes
1answer
3k views
Hydra says it found a password, but doesn't show it
I'm running Hydra against a vulnerable VM running on my own server. I'm trying to find the password for the "admin" username.
This is the command I ran:
hydra -vV -l admin -P /root/Documents/...
1
vote
0answers
382 views
Brute Forcing a aspx form using Hydra
I am trying to brute force a Login.aspx page.
It has two text fields - txt_Username and txt_Password
The form submit however looks like this:
<input type="submit" name="btn_Login" value="Login" ...
3
votes
0answers
622 views
Hydra does not display the right answer in DVWA
I have been trying for days now to use Hydra in an attempt to crack DVWA brute force but to no avail, I am using the correct session cookie and to my knowledge have the correct syntax?
Query is:
...
3
votes
0answers
126 views
Why I have more than one valid passwords with Hydra? [duplicate]
I am trying to do a brute force with Hydra on a web page but it isn't DVWA so I don't have control over code.
The failed result has 200 OK response and "Area protegida" message.
I tried it with this ...
3
votes
1answer
2k views
How to brute force a login page of an IP camera created in .asp?
I am new to stackexchange. I desperately need some help. I am doing my thesis on 'IoT Threats', one of my objectives is to try to brute force into an IP camera. I am using Kali Linux Hydra to do the ...
0
votes
1answer
80 views
Bruteforcing a windows mapped network drive with half of the digits known
How do you bruteforce a windows mapped network drive on lan? I know half of the password already and have created a wordlist with crunch. I am not sure how to bruteforce it using hydra or any other ...
0
votes
1answer
309 views
Password security, “hacking” of web pages (hydra)
Our lab at the university was about password security, "hacking" of web pages (using hydra)
So using the command below you manage to get the admin password.
hydra -l root -P /home/ubuntu/rockyou.txt -...
0
votes
0answers
120 views
Hydra returning error: “module option must start with http”
I am trying to brute force a web login password using hydra with the below command:
hydra -s 8123 -x 2:8:aA1 -t 16 -m http://192.168.1.193 http-proxy
I get
[ERROR] module option must start with ...
9
votes
1answer
691 views
How to get and use constantly changing cookie JSESSIONID values in Hydra?
Related: how to get cookies from aspx site to use it with hydra
My problem is similar to the above case, I get "20 valid passwords found" but the server I'm trying to brute force sends the header set-...
