thc-hydra icon indicating copy to clipboard operation
thc-hydra copied to clipboard

[BUG] http-post-form not finding password that is correct

Open xeragon opened this issue 10 months ago • 4 comments

I was messing around with a friend's webapp (he asked for it) and when I'm running this command hydra -l **** -P wl.txt ***********.com https-post-form "/login:pseudo=^USER^&password^PASS^:Mot de passe faux"

so here wl.txt is a short wordlist I made, it only contains a few lines and the correct password is in it, but hydra's result is no password found yet when I tried with -d and -v parmaters I get an interesting thing.

hydra -l ***** -P wl.txt -v ***************..com https-post-form "/login:pseudo=^USER^&password=^PASS^:Mot de passe faux"

Hydra v9.2 (c) 2021 by van Hauser/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway).

Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2023-08-30 11:19:41
[DATA] max 12 tasks per 1 server, overall 12 tasks, 12 login tries (l:1/p:12), ~1 try per task
[DATA] attacking http-post-forms://***************..com:443/login:pseudo=^USER^&password=^PASS^:Mot de passe faux
[VERBOSE] Resolving addresses ... [VERBOSE] resolving done
[STATUS] attack finished for***************.com (waiting for children to complete tests)
[VERBOSE] Page redirected to http://***************.com:443/feed.php
1 of 1 target completed, 0 valid password found
Hydra (https://github.com/vanhauser-thc/thc-hydra) finished at 2023-08-30 11:19:44

so we can see here that hydra finds the correct password since it found the one that made the redirect to /feed but isnt showing it for some reason.

Any idea about why and how to fix it ?

xeragon avatar Aug 30 '23 09:08 xeragon