Questions tagged [hydra]
Hydra (THC Hydra) is a tool to automate brute force attacks against password authentication.
110
questions
1
vote
1answer
176 views
THC Hydra sends GET request without parameter before actual request with parameter which causes authentication problems
I am using THC Hydra (v9.0) on GNU/Linux to pentest my private API.
The GET route in question requires a key as GET parameter which returns an auth token if the correct key was submitted else "...
0
votes
2answers
118 views
Using Hydra not sending traffic to target VM
I have 3 VM's
1 with Ubuntu server version 20.04, apache2, php, mysql and DVWA. (10.0.2.4)
1 with Ubuntu client version 20.04 with hydra installed. (10.0.2.5)
1 with Kali 2021.3. (10.0.2.6)
All VM's ...
-1
votes
1answer
193 views
hydra parse error
$ hydra 127.0.0.1 -l admin -P /usr/share/wordlists/rockyou.txt http-get-form “/dvwa/vulnerabilities/brute/?username=^USER^&password=^PASS^&Login=Login:Username and/or password incorrect.:H=...
0
votes
0answers
180 views
All passwords valid hydra
I was trying hydra out on DVWA login page, but it returned all 7 passwords correct, while only one was correct.
Here is the command:
hydra -l admin -P passlist.txt -V -I 192.168.70.130 http-post-form &...
0
votes
0answers
201 views
Help with hydra https-post-form
I am doing portswigger labs with hydra https-post-form. I try to look for packets that don't have status code 200 OK, because when checked in burp my failed login with bad password and good username ...
0
votes
0answers
61 views
Hydra with a 3-part username
I am using this code in hydra to bruteforce a password
hydra 147.91.xxx.213 http-post-form "/ssasdkaduzsp/do:maticnaKnjiga=ee&brojUGodini=1021&godinaUpisa=20516&pass=^PASS^&action=...
0
votes
1answer
79 views
Prevent Hydra from URL encoding spaces
I'm having some problems with JSON requests in Hydra. I have a wordlist which consists of lots of lines; each with 2 words separated by a space. I run Hydra using the following command:
sudo hydra -l &...
0
votes
0answers
63 views
REST App with Hydra
I tried making a Hydra attack against a rest application locally. However I find it difficult adding the headers (especially the cookie) to the command.
The request that shows on browser is as it ...
0
votes
1answer
435 views
Hydra hangs after TASKS number of tries
I have dvwa set up and i am using the command:
hydra -IV -t 1 -l admin -P rockyou.txt localhost http-get-form "/vulnerabilities/brute/index.php:username=^USER^&password=^PASS^&Login=Login:...
0
votes
0answers
45 views
Bypassing Hydra's 4 billion password limit [duplicate]
I'm trying to get into my friend's email (he is okay with it, we discussed it) and I'm using Hydra, but it has a limit to its bruteforcing that I can't seem to bypass, does anyone know how I can?
1
vote
0answers
96 views
Hydra attack ssh : The message is successful, but when using the errors
I execute the command
hydra -l ubnt -p ubnt 138.255.252.193 -t 4 ssh
I get the message it's successful
Hydra (http://www.thc.org/thc-hydra) starting at 2021-02-22 11:32:05
[DATA] max 1 task per 1 ...
1
vote
2answers
438 views
Brute Forcing DVWA with Hydra
I am attempting to brute-force 'DVWA/vulnerabilities/brute/' with Hydra, rockyou.txt password list.
I tried using this command:
hydra 127.0.0.1 -V -l admin -P rockyou.txt http-get-form "/DVWA/...
0
votes
1answer
263 views
Hydra only executes one try per task then hangs
As in the title, hydra will only execute one try per task before hanging.
$ hydra -l admin -P /usr/share/wordlists/wfuzz/general/common.txt -u 10.10.68.141 http-post-form "/admin:user=^USER^&...
1
vote
1answer
679 views
Run Hydra Through Series of Proxies?
Is there a way to run Hydra through a series of proxies so a website can't lock you out? Having a hard time finding a way to do this. Most websites will block you out if you take to many attempts at ...
0
votes
2answers
272 views
password brute force over ssh? (not on ssh)
Can Hydra ssh to remote host and attempt a password list against su root?
I am trying to recover the root password to an old device. It is an old Apple jailbroken Apple device, running IOS8.
The ...
1
vote
1answer
659 views
Hydra http-post-form based on length of the response
is there any way for hydra to understand the correct combination ^USER^ and ^PASS^ in a http-post-form authentication attack based on the length of the body response?
Like in Burpsuite you can look at ...
0
votes
1answer
215 views
Hydra brute-force login with a timestamp
I am attempting to run a brute-force attack on my router just as a proof of concept and have hit a problem in that the POST request requires a parameter of the current timestamp. Here is my current ...
0
votes
1answer
130 views
wfuzz default number of connects in parallel per target?
In Hydra, default number of connects in parallel per target is 16 and it can be changed with -t flag.
E.g. -t 100 for 100 connection in parallel per target.
wolf@linux:~$ hydra -h | grep parallel
-...
0
votes
1answer
640 views
How to reduce false positive in hydra http-post-form module due to more than 1 error?
This question is based on security challenge on Basic Pentesting: 1.
Feel free to download if you want to reproduce this issue as well.
It's easy to do this if there's only a single error message ...
0
votes
1answer
2k views
Bruteforce all IP addresses on network with Hydra
I have been tasked to pen test a computer on my network. I have done some social engineering to get the username and password of the device, and I know ssh is open on the computer. However, I do not ...
0
votes
0answers
527 views
HTC Hydra does not show the password and username obtained
I am doing a practice with Hydra in Kali Linux 2020. The problem i have is that when finish the process and obtain a correct password, it does not show me the password obtained, what it does show is ...
0
votes
0answers
47 views
Hydra THC - Get failed login [duplicate]
I'm trying to get a password from a website (From my account, I know the password) using Hydra. The problem: I can't find any usable feedback from the website telling Hydra if the password is wrong or ...
1
vote
1answer
2k views
Hydra hangs after attempts or returns all passwords valid
I'm using the Hydra tool on Kali Linux 2020.1 and I'm trying to brute force a login at hack.me http://s123056-104737-qer.sipontum.hack.me/login.php.
My problem is that whenever I run Hydra it gets ...
0
votes
0answers
160 views
Input multiple password files
I have a number of relatively small password files that I'd like to use with Hydra in one go without having to manually merge them but it seems that it doesn't natively support this or stdin.
From ...
2
votes
1answer
916 views
Hydra HTTP Form Post with parameters containing a colon ":"
I'm trying to brute force login on my domain using THC Hydra v9.1-dev. It is using an ASP.net form and some of the required post body parameters contain a colon : in them which is the separator used ...
1
vote
0answers
700 views
Hydra - Brute force command is stalling
Very new to application testing here. I am working through the hacker101 CTF (petshop) examples and I am having problems with brute forcing a username form with Hydra. The error message looks like it ...
0
votes
1answer
138 views
John stdout to Hydra
I'm trying to use a John ruleset which seems to take up more space than I have available. Is there a way to pipe John into Hydra?
0
votes
1answer
126 views
differentiate correct and incorrect password [closed]
So here it is, I had time to kill, so I used it to hack into my own gmail address with THC Hydra. (very fun I know).
So I checked out some old forums and gradually learned how to do it.
I understood ...
1
vote
1answer
197 views
Hydra ( Host Offline redoing attempt)
I tried to brute force a http-get service using -M option with list of servers of which some host are down/offline.
However when hydra reaches to offline host it tries to redo-attempt many times on ...
-1
votes
1answer
3k views
Hydra too slow - Counter BruteForce protection? [closed]
I'm trying to bruteforce with Hydra (I'm a newbie).
But it takes too much time, only 15 attempts in 30 minutes for example...
I tried to inform myself about this problem, and it seems to be slow ...
1
vote
0answers
155 views
Hydra gives different password each time (DVWA)
I've looked up this issue and everyone's problem was they didn't have the failed login string. I do. Trying to get into DVWA.
Here's my command
hydra 10.0.250.143 -l admin -P P.txt http-get-form "/...
1
vote
2answers
2k views
How to brute force only username not password?
I want to find the username first, then pass the username and a password list. I could not find flags to ignore password in Ncrack and other related tools. The device I want to find a username is ...
2
votes
2answers
3k views
Bruteforce - Using Hydra with JSON
Trying for the life of me to get Hydra to work with a JSON request.
General:
Request URL: https://api.myapp.app/api/accounts/login/
Request Method: POST
Status Code: 401 Unauthorized
Remote Address:...
0
votes
1answer
2k views
Using THC Hydra to attack Cisco router
I am trying to do successfull attack on my cisco home router using THC Hydra. I already know a username/password(admin/admin).
First with nmap I looked for open ports on router and only opened one ...
2
votes
1answer
347 views
Is Hydra splitting the wordlist file into as many parts as tasks / threads?
I'm playing around with Hydra and an xmpp authentication.
I created a basic xmpp server of my own, reproducing an authentication (server side) from a clear text pcap file.
I think I got something ...
1
vote
1answer
6k views
Brute-Forcing DVWA login page with hydra
I'm learning how to brute force web login pages with a popular brute force tool called "Hydra". I'm using Kali Linux (VirtualBox) to do this. I've installed DVWA (Damn Vulnerable Web Application) and ...
0
votes
1answer
4k views
THC Hydra on Windows RDP Domain
I am testing a bruteforce on a windows rdp server within a domain. It seems to not be working because nothing is locking out the account I am targeting. How do you specify a domain username? I tried ...
1
vote
2answers
1k views
Finding and attacking an IMAP Server
For a security challenge I am supposed to dictionary attack an IMAP service. A rather simple exercise using hydra.
So far I failed, since I've given hydra the actual website instead of the mail ...
1
vote
1answer
161 views
Online brute force attack which will continue in background [closed]
I don't have enough bandwidth for brute force dictionary attacks so I'm searching for a website or a way that I can do brute force attacks as a background process even if I turn my internet ...
3
votes
2answers
2k views
Hydra gives right password if used after 3 minutes else gives wrong passwords
I have a D-Link DCS 5222LB IP camera. I am trying to bruteforce the IP camera. The camera uses basic HTTP authentication. I use the following command:
hydra -l admin -P passlist.txt -t 3 http://...
2
votes
1answer
536 views
How to interpret the attempt information from Hydra
I was performing a Hydra attack on my TP-Link router and for that I prepared a passwords.txt file with 288 passwords.
hydra -l webadmin -P test_creds/passwords.txt xxx.xxx.xxx.xxx ftp
A minute ...
1
vote
1answer
363 views
Hydra not matching password provided in file
I was pen-testing my TP-Link router yesterday and tried performing a Hydra attack on it. I wrote the following line on the terminal:
hydra -l admin -p passwords.txt 192.168.0.1 http
The username and ...
3
votes
1answer
6k views
Brute Force Post via Hydra
I am trying to brute force an HTTP login form via Hydra.
The problem I am having is in regards to the response code returned by the page. I am receiving false positives on every password.
Even ...
2
votes
1answer
2k views
Is it possible to specify multiple values for failure condition (F=) using Hydra?
I want to brute-force a site using Hydra (https-post-form) that I don't know valid login credentials for, so I cannot specify a value for success condition (S=).
Failed logins result in a redirect ...
1
vote
1answer
3k views
Hydra: Brute force an http form, all arguments are supplied but the login error has other string formats and is too big
I am using Hydra to brute force a login http form (Method: post), but I'm getting false positives (passwords that aren't valid)
I believe I know the reason, I just don't know how to handle it:
The ...
1
vote
1answer
990 views
How can i fine tune hydra to find the correct password
I am having a bit of a pickle getting hydra to see the correct password when the page is redirected. The condition where the password is correct is if the login is redirected to a certain page in the ...
0
votes
1answer
543 views
Unable to display login username in Hydra [closed]
So I'm performing an authentication cracking lab using Hydra, I use the following command;
hydra -L /usr/share/ncrack/minimal.usr -P /usr/share/wordlists/s1.txt -f -V 192.168.99.22 telnet
The ...
4
votes
1answer
1k views
Hydra - Attacking when login page encodes the username and password
I needed to test how Hydra works, so I tried to attack my own wifi router. I set the user name as "user" and created a txt file containing 100 passwords including the "real" password.
I am unable to ...
0
votes
1answer
12k views
Simple Hydra test with Windows RDP
I am using VMware and have 3 VMs all on the NAT network with DHCP. All three machines can ping each other. From one windows to the other windows, I can RDP into the 192.168.190.130 windows machine ...
1
vote
2answers
2k views
Piping crunch into hydra
Is it possible to pipe the output from crunch into hydra ?
I tried this, but it doesn't work:
crunch 1 6 123456 --stdout | hydra -S -l ---------@gmail.com -v -V -e nsr -s 465 smtp.gmail.com smtp
