Unsure if I have understood Hydra syntax correctly

brute force

So, when I see the Hydra help file, this is what it says:

Syntax: hydra [[[-l LOGIN|-L FILE] [-p PASS|-P FILE]] | [-C FILE]] [-e nsr] [-o FILE] [-t TASKS] [-M FILE [-T TASKS]] [-w TIME] [-W TIME] [-f] [-s PORT] [-x MIN:MAX:CHARSET] [-SuvVd46] [service://server[:PORT][/OPT]]

The service I am interested in is http-get-form. When I look at the help for this module, I need to use the module like this:

<url>:<form parameters>:<condition string>[:<optional>[:<optional>]

From the examples that the help file provides, I need to use it like so –

"/login.php:user=^USER^&pass=^PASS^:incorrect"

I construct a query like so –

hydra -L usernames.txt -P passwords.txt http-get-form://site.appspot.com "/lab/webapp/1:email=^USER^&password=^PASS^:Failed"

Hydra fails with the error Unknown service: lab/webapp/1:email=^USER^&password=^PASS^:Failed

Looking at this post here, it may be that Hydra no longer support that syntax form. I know that there is an alternate syntax that I could use which works. However, I would like to know what I am doing wrong with the syntax that I am using.

Best Answer

I guess syntax description is correct for http service only :)

Change your command line into this, and will do the trick. I have tested on 8.1 version

hydra -L usernames.txt -P passwords.txt site.appspot.com http-get-form "/lab/webapp/1:email=^USER^&password=^PASS^:Failed"

Related Solutions

Increase hydra brute force login attempts

(AFAIK) There is not an explicit "tries per second" config option in HYDRA, normally you can define the number of tasks that will be involved in the attack. I have checked the default option and it is 16 (in the command line utility), so I believe that the service you are trying to test against might have a big latency or some kind of delay before answering wrong attempts. Anyway you could try to tune it by increasing the number of tasks with the option "-t".

The latter is not an uncommon solution so you can expect that, also, you should consider that many services will temporary blacklist your IP if you try to log-in more than "n" times (being "n" an small number of tries like 5 or 10).

Here you have an Hydra manual for both command line and GUI utility.

MacOS – How to get thc-hydra to work from homebrew installation

brew info hydra shows:

hydra: stable 8.1 (bottled), HEAD
https://www.thc.org/thc-hydra/
Not installed
From: https://github.com/Homebrew/homebrew/blob/master/Library/Formula/hydra.rb
==> Dependencies
Build: pkg-config ✔
Required: openssl ✔
Optional: subversion ✘, libidn ✘, libssh ✘, pcre ✔, gtk+ ✔
==> Options
--with-gtk+
    Build with gtk+ support
--with-libidn
    Build with libidn support
--with-libssh
    Build with libssh support
--with-pcre
    Build with pcre support
--with-subversion
    Build with subversion support
--HEAD
    Install HEAD version

To allow ssh support, install using command:

brew install hydra --with-libssh

It is always a good idea to use brew info before running brew install

Related Question