1

I'm trying to use a Hydra script in the following scenario on localhost and Linux:

After web form login, my app redirects to another page with header(Location: internalpage.php)

I use this syntax but how can I edit in order to give the S= parameter for login successfully done? because every time hydra returns, additional the right password, also the wrong password. Thanks

hydra localhost http-form-post "/admin/login.php:username=^USER^&password=^PASS^&submit=Login:access not valid" -L users.txt -P pass.txt -t 7 -w 30 -vV -o output.txt

Thank you

Xander
  • 35,525
  • 27
  • 113
  • 141
miagu
  • 11
  • 1
  • Can you see if there's a string in the HTTP response when you request it with curl? Some pages do a 302, but also have HTTP content. – ndrix Jan 14 '15 at 20:37
  • In the Apache2 log, I can see this exact row every time the attack finds the right password: 127.0.0.1 - - [15/Jan/2015:19:53:13 +0100] "GET /app/internalpage.ph HTTP/1.0" 404 3549 "-" "Mozilla/4.0 (Hydra)" Note the .ph extension and the 404 error generated. If I access to the form via browser I can login and redirect without 404 error! – miagu Jan 15 '15 at 19:02

0 Answers0