Questions tagged [hydra]
Hydra (THC Hydra) is a tool to automate brute force attacks against password authentication.
85
questions
0
votes
1answer
64 views
differentiate correct and incorrect password [closed]
So here it is, I had time to kill, so I used it to hack into my own gmail address with THC Hydra. (very fun I know).
So I checked out some old forums and gradually learned how to do it.
I understood ...
0
votes
0answers
46 views
Hydra ( Host Offline redoing attempt)
I tried to brute force a http-get service using -M option with list of servers of which some host are down/offline.
However when hydra reaches to offline host it tries to redo-attempt many times on ...
-1
votes
1answer
85 views
Hydra too slow - Counter BruteForce protection? [closed]
I'm trying to bruteforce with Hydra (I'm a newbie).
But it takes too much time, only 15 attempts in 30 minutes for example...
I tried to inform myself about this problem, and it seems to be slow ...
1
vote
0answers
48 views
Hydra gives different password each time (DVWA)
I've looked up this issue and everyone's problem was they didn't have the failed login string. I do. Trying to get into DVWA.
Here's my command
hydra 10.0.250.143 -l admin -P P.txt http-get-form "/...
0
votes
0answers
65 views
Where are Advanced Hydra Options for http-form-post Documented?
I'm trying to brute force a login page (checklogin.htm) that returns a blank response in the event of a failed login, instead it forcing a browser redirect to a different page (login.htm), passing a ...
0
votes
0answers
46 views
What's the proper way to identify string values in hydra http post form
I've seen plenty of posts regarding the syntax for setting http post form's when using hydra and all of them just show username and password as being the only two keys when making a login post request....
0
votes
2answers
274 views
How to brute force only username not password?
I want to find the username first, then pass the username and a password list. I could not find flags to ignore password in Ncrack and other related tools. The device I want to find a username is ...
0
votes
0answers
105 views
Using Hydra with JSON
My question is simply a follow up question to these two similar threads:
Bruteforce - Using Hydra with JSON
How to run Hydra with json response?
My question is: What if the JSON file has this text ...
1
vote
2answers
404 views
Bruteforce - Using Hydra with JSON
Trying for the life of me to get Hydra to work with a JSON request.
General:
Request URL: https://api.myapp.app/api/accounts/login/
Request Method: POST
Status Code: 401 Unauthorized
Remote Address:...
0
votes
1answer
567 views
Using THC Hydra to attack Cisco router
I am trying to do successfull attack on my cisco home router using THC Hydra. I already know a username/password(admin/admin).
First with nmap I looked for open ports on router and only opened one ...
2
votes
1answer
120 views
Is Hydra splitting the wordlist file into as many parts as tasks / threads?
I'm playing around with Hydra and an xmpp authentication.
I created a basic xmpp server of my own, reproducing an authentication (server side) from a clear text pcap file.
I think I got something ...
0
votes
1answer
2k views
Brute-Forcing DVWA login page with hydra
I'm learning how to brute force web login pages with a popular brute force tool called "Hydra". I'm using Kali Linux (VirtualBox) to do this. I've installed DVWA (Damn Vulnerable Web Application) and ...
0
votes
1answer
2k views
THC Hydra on Windows RDP Domain
I am testing a bruteforce on a windows rdp server within a domain. It seems to not be working because nothing is locking out the account I am targeting. How do you specify a domain username? I tried ...
1
vote
2answers
629 views
Finding and attacking an IMAP Server
For a security challenge I am supposed to dictionary attack an IMAP service. A rather simple exercise using hydra.
So far I failed, since I've given hydra the actual website instead of the mail ...
1
vote
1answer
114 views
Online brute force attack which will continue in background [closed]
I don't have enough bandwidth for brute force dictionary attacks so I'm searching for a website or a way that I can do brute force attacks as a background process even if I turn my internet ...
3
votes
2answers
634 views
Hydra gives right password if used after 3 minutes else gives wrong passwords
I have a D-Link DCS 5222LB IP camera. I am trying to bruteforce the IP camera. The camera uses basic HTTP authentication. I use the following command:
hydra -l admin -P passlist.txt -t 3 http://...
2
votes
1answer
187 views
How to interpret the attempt information from Hydra
I was performing a Hydra attack on my TP-Link router and for that I prepared a passwords.txt file with 288 passwords.
hydra -l webadmin -P test_creds/passwords.txt xxx.xxx.xxx.xxx ftp
A minute ...
1
vote
1answer
134 views
Hydra not matching password provided in file
I was pen-testing my TP-Link router yesterday and tried performing a Hydra attack on it. I wrote the following line on the terminal:
hydra -l admin -p passwords.txt 192.168.0.1 http
The username and ...
2
votes
1answer
1k views
Brute Force Post via Hydra
I am trying to brute force an HTTP login form via Hydra.
The problem I am having is in regards to the response code returned by the page. I am receiving false positives on every password.
Even ...
1
vote
1answer
416 views
Is it possible to specify multiple values for failure condition (F=) using Hydra?
I want to brute-force a site using Hydra (https-post-form) that I don't know valid login credentials for, so I cannot specify a value for success condition (S=).
Failed logins result in a redirect ...
1
vote
1answer
617 views
Hydra: Brute force an http form, all arguments are supplied but the login error has other string formats and is too big
I am using Hydra to brute force a login http form (Method: post), but I'm getting false positives (passwords that aren't valid)
I believe I know the reason, I just don't know how to handle it:
The ...
1
vote
1answer
465 views
How can i fine tune hydra to find the correct password
I am having a bit of a pickle getting hydra to see the correct password when the page is redirected. The condition where the password is correct is if the login is redirected to a certain page in the ...
1
vote
0answers
207 views
Unable to display login username in Hydra
So I'm performing an authentication cracking lab using Hydra, I use the following command;
hydra -L /usr/share/ncrack/minimal.usr -P /usr/share/wordlists/s1.txt -f -V 192.168.99.22 telnet
The ...
4
votes
1answer
406 views
Hydra - Attacking when login page encodes the username and password
I needed to test how Hydra works, so I tried to attack my own wifi router. I set the user name as "user" and created a txt file containing 100 passwords including the "real" password.
I am unable to ...
0
votes
1answer
5k views
Simple Hydra test with Windows RDP
I am using VMware and have 3 VMs all on the NAT network with DHCP. All three machines can ping each other. From one windows to the other windows, I can RDP into the 192.168.190.130 windows machine ...
1
vote
2answers
595 views
Piping crunch into hydra
Is it possible to pipe the output from crunch into hydra ?
I tried this, but it doesn't work:
crunch 1 6 123456 --stdout | hydra -S -l ---------@gmail.com -v -V -e nsr -s 465 smtp.gmail.com smtp
0
votes
1answer
2k views
Hydra brute force error message
hydra 190.13.132.90 -s 8081 -V -L /home/nicolas/Escritorio/USER -P /home/nicolas/Escritorio/passwords.txt http-post-form "/user=^USER^&password=^PASS^=Ingresar&culture=es-CL&mobile=0&...
3
votes
1answer
317 views
Hydra - all passwords work
I want to test some mechanisms of my website when the password of a single user is entered a lot of times in a short time incorrectly in the login form.
Therefore I got Hydra (for windows) on GitHub.
...
0
votes
2answers
4k views
Hydra fails with “[ERROR] target ssh://192.168.16.128:22/ does not support password authentication.”?
I've updated Kali 2.0 to newest version - it is installed using VMWare.
Now, every time I use hydra to brute-force SSH, I get the following error:
[ERROR] target ssh://192.168.16.128:22/ does not ...
1
vote
0answers
158 views
Using hydra on a website that has the same response for both a wrong and correct password
I got my hands on an old-ish residential gateway with SIP support and two analog phone connections. I want to use it for it's SIP support to use analog phones with my SIP provider. I didn't know the ...
-2
votes
1answer
787 views
Hydra shows 1 valid password found but shows password as wordlist location [closed]
When I use hydra to crack a router's password, it shows that 1 valid password found but shows the location of my wordlist as the password.
That IP is not mine, I got it from shodan.io. I wanted to ...
1
vote
0answers
334 views
THC Hydra false positives on Foscam login
I bought a Foscam C1 Lite this week and I want to try to brute force the login page with THC hydra.
But currently I am getting false positives with the following command:
hydra -s 88 -l user -P ...
2
votes
1answer
215 views
What's the fastest protocol to target for password attacks
In a Windows domain environment, there are numerous protocols (SMB, LDAP, Webpages, RDP, FTP, etc.) that query against the same Windows based AD. Many of these protocols have their own overhead that ...
-4
votes
1answer
1k views
Hydra brute-force not working [closed]
This is the command I am using and when I press Enter :
hydra -L username.txt -P passwords.txt localhost http-post-form "dvwa/login.php:username=^USER^&password=^PASS^&Login="Login Failed"
>
...
4
votes
1answer
351 views
Wireshark HTTP continuations (Hydra HTTP version)
I am trying to use Hydra to brute force a HTTP POST form page, however the page is returning a HTTP Continuation I'm not sure what that is.
This is being caused by the HTTP/1.0 at the top of the ...
0
votes
1answer
2k views
Getting [ERROR] Invalid target definition! while specifying https://mysitename.com in Hydra Gtk
In Hydra-GTK, I've specified my target name as https://example.com (it's not www) and mentioned protocol as https-post-form and then entered username and password list and then I started.
But I got ...
1
vote
1answer
2k views
Hydra says it found a password, but doesn't show it
I'm running Hydra against a vulnerable VM running on my own server. I'm trying to find the password for the "admin" username.
This is the command I ran:
hydra -vV -l admin -P /root/Documents/...
1
vote
0answers
265 views
Brute Forcing a aspx form using Hydra
I am trying to brute force a Login.aspx page.
It has two text fields - txt_Username and txt_Password
The form submit however looks like this:
<input type="submit" name="btn_Login" value="Login" ...
3
votes
0answers
544 views
Hydra does not display the right answer in DVWA
I have been trying for days now to use Hydra in an attempt to crack DVWA brute force but to no avail, I am using the correct session cookie and to my knowledge have the correct syntax?
Query is:
...
3
votes
0answers
106 views
Why I have more than one valid passwords with Hydra? [duplicate]
I am trying to do a brute force with Hydra on a web page but it isn't DVWA so I don't have control over code.
The failed result has 200 OK response and "Area protegida" message.
I tried it with this ...
3
votes
1answer
2k views
How to brute force a login page of an IP camera created in .asp?
I am new to stackexchange. I desperately need some help. I am doing my thesis on 'IoT Threats', one of my objectives is to try to brute force into an IP camera. I am using Kali Linux Hydra to do the ...
0
votes
1answer
71 views
Bruteforcing a windows mapped network drive with half of the digits known
How do you bruteforce a windows mapped network drive on lan? I know half of the password already and have created a wordlist with crunch. I am not sure how to bruteforce it using hydra or any other ...
0
votes
1answer
266 views
Password security, “hacking” of web pages (hydra)
Our lab at the university was about password security, "hacking" of web pages (using hydra)
So using the command below you manage to get the admin password.
hydra -l root -P /home/ubuntu/rockyou.txt -...
0
votes
0answers
112 views
Hydra returning error: “module option must start with http”
I am trying to brute force a web login password using hydra with the below command:
hydra -s 8123 -x 2:8:aA1 -t 16 -m http://192.168.1.193 http-proxy
I get
[ERROR] module option must start with ...
9
votes
1answer
552 views
How to get and use constantly changing cookie JSESSIONID values in Hydra?
Related: how to get cookies from aspx site to use it with hydra
My problem is similar to the above case, I get "20 valid passwords found" but the server I'm trying to brute force sends the header set-...
0
votes
1answer
529 views
Kali Linux Hydra question
Recently a friend of mine coded a website and he asked me to brute force it to test it
HTML code of the page trying to use hydra on
https://pastebin.com/D2iQXrNb (use Pastebin because I don't know ...
2
votes
3answers
1k views
Can I slow down a brute force attack by encoding password input data?
I'm building a php login form with only a username & password as $_POST data. But before submitting the form, a JS function check() will base64_encode the password input, then finally submits the ...
1
vote
0answers
3k views
Brute Force with Hydra Ignore timeout and 4 billion limit
We are doing an assignment where we are hacking eachothers websites or servers in school. I know the default username and know the default password is 32 characters long to ssh in.
While I know I ...
1
vote
0answers
3k views
Trying to figure out the password for my IP Camera using Hydra
I have a client who has an IP camera, and I'm trying to crack the password using Hydra. It seems to have cracked the password, but when I try logging into it, the username and password dialogue keeps ...
2
votes
0answers
2k views
Intercepting hydra with burp suite
I'm using burp suite as a proxy and when I run hydra, burp suite should be able to catch that and log it in HTTP history, but instead of that I get the error
Can not connect [unreachable]
I tried ...
