8
votes
Accepted
Hydra says it found a password, but doesn't show it
The passwords file that I've sent to Hydra contains an empty line (i.e. ""). When this value is sent to the web app, the response is "The password is empty", which is different from the "is incorrect" ...
- 301
6
votes
Accepted
Can I slow down a brute force attack by encoding password input data?
Can I slow down a brute force attack by encoding password input data?
Yes, you can artificially slow down a brute-force attack by having the client perform an expensive task for each login attempt. ...
- 45.1k
5
votes
Accepted
Hydra - Attacking when login page encodes the username and password
As the code clearly indicates, the name, password, and verification token are hashed together before being sent over the network. So, no, you cannot figure out which is which just from the network ...
- 132k
4
votes
Can I slow down a brute force attack by encoding password input data?
No, this idea won't slow down an attacker, because the encoded password is the password-- it is the value that an HTTP client needs to access the system. The original password is almost incidental at ...
- 9,361
4
votes
Hydra brute force error message
The http-post-form module requires three colon-separated arguments, like so:
/login.php:username=^USER^&password=^PASS^:login failed
The "variables argument" where you supply the POST data with ...
- 45.1k
3
votes
Accepted
Online brute force attack which will continue in background
Offering such a service to the public could be abused for illegal purposes. So you won't find anyone offering such a service for free to anonymous users.
When you are penetration-testing a system ...
- 49.6k
3
votes
Accepted
Is it possible to specify multiple values for failure condition (F=) using Hydra?
Assuming Hydra was compiled with PCRE (regular expression) support, the pattern you supply should be treated as a regular expression. You should be able to use | as a pattern "or" operator.
Here's ...
- 674
3
votes
What's the fastest protocol to target for password attacks
I haven't precisely done what you're describing, but I would expect most online bruteforce and dictionary attacks to quickly run into account lockout thresholds.
One workaround for this is password ...
- 9,717
3
votes
Finding and attacking an IMAP Server
The initial intuition would be that there is no way to tell a domain's IMAP server in a similar way as you could just lookup a domain's MX (SMTP) server through the DNS system.
But there is; at least ...
- 838
3
votes
Bruteforce all IP addresses on network with Hydra
Did you try listing the options for Hydra with hydra -h or man hydra?
-M FILE list of servers to be attacked in parallel, one entry per line
(No, you didn't.)
- 19.4k
3
votes
Accepted
Why does Hydra SMB attack not work while Metasploit does?
TL;DR - Hydra defaults to NTLM dialect but in your use case it requires LMv2.
Hydra v8.6 (c) 2017 by van Hauser/THC - Please do not use in military or secret service organizations, or for illegal ...
- 2,260
2
votes
How to get and use constantly changing cookie JSESSIONID values in Hydra?
You can keep the session ID in the http response in a variable in the python prox and you can also send this session key with http requests.
https://forums.kali.org/showthread.php?18055-Hydra-using-...
- 21
2
votes
Brute force on Hydra with non-ASCII usernames and passwords
This seem linked to language environment:
You could try:
LANG=C LANGUAGE=C hydra -L usernames.txt -P passwords.txt \
www.xxxxx.com http-post-form \
"/login.php:log_user=^USER^&log_pass=^PASS^...
2
votes
Password Cracking Twitter With THC Hydra
I'm not sure how you're legally brute forcing Twitter. But you could try to drop the http from the URI. That fixed the segfault errors for me. It seems it can be triggered by unexpected syntax.
It ...
- 402
2
votes
Hydra shows 1 valid password found but shows password as wordlist location
Note that trying to attack a random device you found on Shodan is very likely illegal, and by providing this answer, I do not condone or support any illegal activities. Instead, I highly suggest that ...
- 13.2k
2
votes
Accepted
Getting [ERROR] Invalid target definition! while specifying https://mysitename.com in Hydra Gtk
You should NOT put the https:// part in your site parameter, see the following example:
hydra example.com http-form-post "/password.php:user=^USER^&pass=^PASS^:Bad login" -L users.txt -P pass.txt ...
- 1,574
2
votes
Hydra: Brute force an http form, all arguments are supplied but the login error has other string formats and is too big
Typically you'd want your match string to just be long enough to prevent any false negatives/positives and nothing more. Given that your string includes accented characters, I would also strongly ...
- 674
2
votes
How can i fine tune hydra to find the correct password
Without seeing your test webpage it's hard to say. However, looking at Hydra's source code, it appears to follow redirects and eventually inspects the content of the final page (assuming it didn't ...
- 674
2
votes
Unable to display login username in Hydra
Check your /usr/share/ncrack/minimal.usr file...
Remove the line # minimal list of very common username from the file; otherwise, Hydra will not work as expected.
- 121
2
votes
Hydra gives right password if used after 3 minutes else gives wrong passwords
I Have figured out the issue. Hydra considers 401 as the Fail Response and 200 as the "Success" response. It also considers 403 as success response. My IP-Camera is smart enough to identify that hydra ...
- 51
2
votes
Brute Force Post via Hydra
Getting a 200 response is fine. You need to tell Hydra what to look for in the response page.
For example, if I log into SocialSite.com/login.php and my creds are wrong, the login page will return ...
- 1,471
2
votes
Accepted
Hydra http-post-form based on length of the response
I'm not sure if this is possible to do with Hydra, but I would recommend using ffuf for this.
You can do an HTTP-POST form bruteforce based on length like this:
ffuf -w /path/to/wordlist.txt -X POST -...
- 303
2
votes
hydra parse error
Delete the quotes and write them again.
It seems like you copied that command from somewhere and the quotes came formatted.
- 21
1
vote
Piping crunch into hydra
I think, after a few searches, that it's not possible as hydra doesn't read stdin by design, and there are no options to use in order to achieve this.
But it can be a great improvement indeed.
- 91
1
vote
How to interpret the attempt information from Hydra
You are misinterpreting the output.
5124095576030430:60h is not a ratio of tries to the number of hours. That's the number of hours it is going to take.
The number of tries is plainly explained:
...
- 132k
1
vote
Hydra not matching password provided in file
Hydra parameters are case-sensitive.
In your specific situation, -p is used as password input parameter, while -P is used as input for reading a file (Official syntax: [-p PASS|-P FILE] ).
- 8,939
1
vote
Hydra fails with "[ERROR] target ssh://192.168.16.128:22/ does not support password authentication."?
SSH supports several different authentication mechanisms. The password authentication mechanism has the client send the password to the server as a password. The more-common keyboard-interactive ...
- 11.8k
1
vote
Accepted
Hydra brute-force not working
You have not properly escaped the " and they don't match up. What you are seeing is your shell waiting for additional input because the second closing " is missing.
Not that on the site where you ...
- 1,990
1
vote
Wireshark HTTP continuations (Hydra HTTP version)
Hydra's HTTP Form module only uses HTTP/1.0 as can be seen in the source. You could probably modify the source to send HTTP/1.1, though I can't guarantee its implementation is otherwise conforming. ...
- 16.1k
1
vote
How to brute force a login page of an IP camera created in .asp?
"All the examples I have looked shows only how to do a brute force for the extension .php?. The login page of the IP camera I am testing however is in .asp"
extension of .php vs .asp should not ...
- 6,923
Only top scored, non community-wiki answers of a minimum length are eligible