Skip to main content
8 votes
Accepted

Hydra says it found a password, but doesn't show it

The passwords file that I've sent to Hydra contains an empty line (i.e. ""). When this value is sent to the web app, the response is "The password is empty", which is different from the "is incorrect" ...
MyName's user avatar
  • 291
6 votes
Accepted

Can I slow down a brute force attack by encoding password input data?

Can I slow down a brute force attack by encoding password input data? Yes, you can artificially slow down a brute-force attack by having the client perform an expensive task for each login attempt. ...
Arminius's user avatar
  • 44.8k
5 votes
Accepted

Hydra - Attacking when login page encodes the username and password

As the code clearly indicates, the name, password, and verification token are hashed together before being sent over the network. So, no, you cannot figure out which is which just from the network ...
schroeder's user avatar
  • 129k
5 votes

How to run Hydra with json response?

Found solution: hydra bbsite https-get-form "/crp/login:username=^USER^&password=^PASS^:F={\"success\"\:false,\"greska\"\:\"Pogre\\\u0161no\"}" -l admin -P /root/Downloads/pass.txt Needed to ...
Daniel Max's user avatar
4 votes

Can I slow down a brute force attack by encoding password input data?

No, this idea won't slow down an attacker, because the encoded password is the password-- it is the value that an HTTP client needs to access the system. The original password is almost incidental at ...
John Wu's user avatar
  • 9,301
4 votes

Hydra brute force error message

The http-post-form module requires three colon-separated arguments, like so: /login.php:username=^USER^&password=^PASS^:login failed The "variables argument" where you supply the POST data with ...
Arminius's user avatar
  • 44.8k
3 votes

What's the fastest protocol to target for password attacks

I haven't precisely done what you're describing, but I would expect most online bruteforce and dictionary attacks to quickly run into account lockout thresholds. One workaround for this is password ...
Royce Williams's user avatar
3 votes

Trying to dictionary attack my own gmail account with hydra on smtp

Download Damn Vulnerable Web Application at this site. Its awesome and free you can try hack it without consequence. Good luck Also read up on this and this I use this type of command hydra 192....
Jonas's user avatar
  • 189
3 votes
Accepted

Is it possible to specify multiple values for failure condition (F=) using Hydra?

Assuming Hydra was compiled with PCRE (regular expression) support, the pattern you supply should be treated as a regular expression. You should be able to use | as a pattern "or" operator. Here's ...
Mr. Llama's user avatar
  • 674
3 votes
Accepted

Online brute force attack which will continue in background

Offering such a service to the public could be abused for illegal purposes. So you won't find anyone offering such a service for free to anonymous users. When you are penetration-testing a system ...
Philipp's user avatar
  • 49.4k
3 votes

Bruteforce all IP addresses on network with Hydra

Did you try listing the options for Hydra with hydra -h or man hydra? -M FILE list of servers to be attacked in parallel, one entry per line (No, you didn't.)
Esa Jokinen's user avatar
2 votes

Hydra when redirects

Replace /se/invalidLogin with some page text that's encountered when the login is wrong. e.g. "Incorrect password" Hydra will check the text on the redirect target.
SilverlightFox's user avatar
2 votes

Can't get into Damn Vulnerable Web App with Hydra even though correct password is supplied

If I read the source for login.php correctly (at https://github.com/RandomStorm/DVWA/blob/master/login.php) the page does a check for an anti-CSRF token. If it is not there, you will get a redirect ...
Mark Koek's user avatar
  • 1,331
2 votes

Trying to dictionary attack my own gmail account with hydra on smtp

What you are doing is a violation of the Gmail Terms of Service. Applicable text: Don’t misuse our Services. For example, don’t interfere with our Services or try to access them using a method ...
Bradley Evans's user avatar
2 votes

Hydra returning incorrect passwords

You can try brutus. It's easier than hydra. In order to perform a brute force attack, you need to understand the HTML source of the login page. The correct field values must then be fed to your ...
MS Guy's user avatar
  • 95
2 votes

Password Cracking Twitter With THC Hydra

I'm not sure how you're legally brute forcing Twitter. But you could try to drop the http from the URI. That fixed the segfault errors for me. It seems it can be triggered by unexpected syntax. It ...
Info5ek's user avatar
  • 402
2 votes

Brute force on Hydra with non-ASCII usernames and passwords

This seem linked to language environment: You could try: LANG=C LANGUAGE=C hydra -L usernames.txt -P passwords.txt \ www.xxxxx.com http-post-form \ "/login.php:log_user=^USER^&log_pass=^PASS^...
F. Hauri  - Give Up GitHub's user avatar
2 votes

Unable to display login username in Hydra

Check your /usr/share/ncrack/minimal.usr file... Remove the line # minimal list of very common username from the file; otherwise, Hydra will not work as expected.
gangelo's user avatar
  • 121
2 votes

Hydra shows 1 valid password found but shows password as wordlist location

Note that trying to attack a random device you found on Shodan is very likely illegal, and by providing this answer, I do not condone or support any illegal activities. Instead, I highly suggest that ...
multithr3at3d's user avatar
2 votes
Accepted

Getting [ERROR] Invalid target definition! while specifying https://mysitename.com in Hydra Gtk

You should NOT put the https:// part in your site parameter, see the following example: hydra example.com http-form-post "/password.php:user=^USER^&pass=^PASS^:Bad login" -L users.txt -P pass.txt ...
galoget's user avatar
  • 1,514
2 votes

How to get and use constantly changing cookie JSESSIONID values in Hydra?

You can keep the session ID in the http response in a variable in the python prox and you can also send this session key with http requests. https://forums.kali.org/showthread.php?18055-Hydra-using-...
Potti's user avatar
  • 21
2 votes

How can i fine tune hydra to find the correct password

Without seeing your test webpage it's hard to say. However, looking at Hydra's source code, it appears to follow redirects and eventually inspects the content of the final page (assuming it didn't ...
Mr. Llama's user avatar
  • 674
2 votes

Hydra: Brute force an http form, all arguments are supplied but the login error has other string formats and is too big

Typically you'd want your match string to just be long enough to prevent any false negatives/positives and nothing more. Given that your string includes accented characters, I would also strongly ...
Mr. Llama's user avatar
  • 674
2 votes

Brute Force Post via Hydra

Getting a 200 response is fine. You need to tell Hydra what to look for in the response page. For example, if I log into SocialSite.com/login.php and my creds are wrong, the login page will return ...
DotNetRussell's user avatar
2 votes

Hydra gives right password if used after 3 minutes else gives wrong passwords

I Have figured out the issue. Hydra considers 401 as the Fail Response and 200 as the "Success" response. It also considers 403 as success response. My IP-Camera is smart enough to identify that hydra ...
Asad's user avatar
  • 51
2 votes
Accepted

Hydra http-post-form based on length of the response

I'm not sure if this is possible to do with Hydra, but I would recommend using ffuf for this. You can do an HTTP-POST form bruteforce based on length like this: ffuf -w /path/to/wordlist.txt -X POST -...
Khalid's user avatar
  • 183
2 votes

hydra parse error

Delete the quotes and write them again. It seems like you copied that command from somewhere and the quotes came formatted.
Joel Russo's user avatar
2 votes
Accepted

Why does Hydra SMB attack not work while Metasploit does?

TL;DR - Hydra defaults to NTLM dialect but in your use case it requires LMv2. Hydra v8.6 (c) 2017 by van Hauser/THC - Please do not use in military or secret service organizations, or for illegal ...
kenlukas's user avatar
  • 1,961
1 vote

Piping crunch into hydra

I think, after a few searches, that it's not possible as hydra doesn't read stdin by design, and there are no options to use in order to achieve this. But it can be a great improvement indeed.
T. Rode's user avatar
  • 91
1 vote

Hydra fails with "[ERROR] target ssh://192.168.16.128:22/ does not support password authentication."?

SSH supports several different authentication mechanisms. The password authentication mechanism has the client send the password to the server as a password. The more-common keyboard-interactive ...
bonsaiviking's user avatar
  • 11.7k

Only top scored, non community-wiki answers of a minimum length are eligible