1 
hydra http://192.168.0.24:1234/ http-form-post "/password=^PASS^:Invalid password!" -P pass.txt -t 10 -o hydra-http-post-attack.txt
Hydra v8.1 (c) 2014 by van Hauser/THC - Please do not use in military or secret service organizations, or for illegal purposes.

Hydra (http://www.thc.org/thc-hydra) starting at 2018-01-03 12:12:37
[INFO] Using HTTP Proxy: http://127.0.0.1:8080
[ERROR] the variables argument needs at least the strings ^USER^ or ^PASS^: Invalid password!

I'm not sure why I am getting the error as there is the ^PASS^ string. There is no username on the application.

The full URL of the login form is: http://192.168.0.24:1234/

Can anyone help?

Improve this question
1
  • This looks like you need to read the documentation a bit more and doublecheck your syntax. For instance: "/:password=^PASS^
    – schroeder
    Jan 3, 2018 at 13:29

1 Answer 1

Reset to default
2

About your question:

  1. When using hydra, it's not required to put http:// before the host that you're going to attack.
  2. To specify the port, please use the -s flag.
  3. You need to specify the -l flag otherwise an error will show up.
  4. In the POST request you have to specify the file that is going to receive the POST request (e.g. index.php, password.php, validate.php, etc.)
  5. And last, but not least, you have to specify the Success case or the Fail case.

Try the following command, it is the best I can do with the information provided:

hydra -l '' -P pass.txt 192.168.0.24 -s 1234 http-post-form "/index.php:pass=^PASS^:F=Invalid Password!" -t 10 -o hydra-http-post-attack.txt

I tried it myself and it does not generate any kind of error.

Good luck!

Improve this answer
4
  • Thanks. The form doesn't seem to be posting anywhere though so the index.php wouldn't be right. It is a challenge application. <form method="POST"> <input type="password" name="password"><br><br> <input type="submit" value="Submit"> </form>
    – Proletariat
    Jan 3, 2018 at 13:37
  • It has to POST to somewhere, this could mean that the same file has the form and validates it, you have to look for the name of that file and then you're done, in most common cases the main page of a website is index.php, so, you can verify this if you go to 192.168.0.24/index.php, if you get the same login form, then you have your answer. Also can you share more details about the challenges, that could be helpful.
    – galoget
    Jan 3, 2018 at 13:41
  • Thanks. Also, is the :F for the fail case documented anywhere? I don't see it in the -h of the tool.
    – Proletariat
    Jan 3, 2018 at 13:43
  • Here you cand find some examples: THC-Hydra with password only login form and How Do I Use THC-Hydra with Password-Only Form Field, don't forget to mark as solved the question if the solution provided worked.
    – galoget
    Jan 3, 2018 at 13:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.