[Beigevenus]

Hello my dear Hackforum associates, I am asking for help at the moment.

You see, recently I started on something new in Kali, attempting to brute force (or generally, just crack) passwords from a website's login form using Hydra.
I'm having some issues getting this to work properly and so I request your help.
Below is the command I use to try and crack the password for a specific e-mail, in this example, from Facebook.

Code

hydra -l <EMAIL> -P <PASSWORD LIST> www.facebook.com https-post form "/login:email=^USER^&pass=^PASS^:doesn't"

The <EMAIL> is supposed to be the e-mail of the account I want to crack.
<PASSWORD LIST> is obviously the password list, or dictionary, I'm using.
The "/login" is the URL of the login page of Facebook.
The "email=^USER^" and "pass=^PASS^" is from using Burp Suite, as I have found out that Facebook names the credentials as such.
The ":doesn't" is supposed to be the string of text Hydra should look for to verify if the password entered were right or wrong as Facebook outputs a string with "doesn't" in it on a failed login attempt.

When this command is run, with my own e-mail and a dictionary containing my own password, Hydra states that none of the passwords in the dictionary is valid. I personally suspect that it's because Hydra doesn't get the error message that I, as a user, does, or maybe it always gets the error, I'm not quite sure.
I've tried my best to resolve this issue on my own and as that has proved unsuccessful, I am now asking you guys.
Thank you in advance!

[rrdein]

Various reasons:

1) Facebook or it's CDN has detected a brute force attempt, perhaps through your user agent or some kind of application-level DDOS or brute force protection, or any number of other means..
2) Facebook's login form is presented via Javascript, which Hydra cannot interpret.

It is most likely that 1) is the problem and 2) never has a chance to occur (though it would). The solution to your problem is to write the application in phantomjs or perhaps Watir (not sure about Watir), and it will take a much much longer time. To get an idea what your script will encounter before you run it, go to facebook.com and manually try to brute force your account. If that doesn't work, there's no way hydra will work (even though it can't work because of the JS).

[Beigevenus]

Various reasons:

1) Facebook or it's CDN has detected a brute force attempt, perhaps through your user agent or some kind of application-level DDOS or brute force protection, or any number of other means..
2) Facebook's login form is presented via Javascript, which Hydra cannot interpret.

It is most likely that 1) is the problem and 2) never has a chance to occur (though it would). The solution to your problem is to write the application in phantomjs or perhaps Watir (not sure about Watir), and it will take a much much longer time. To get an idea what your script will encounter before you run it, go to facebook.com and manually try to brute force your account. If that doesn't work, there's no way hydra will work (even though it can't work because of the JS).

Thank you very much for your response. There's just one thing that's annoying me. Your explaination seems to explain why it wont work on Facebook, however, this haven't worked on any site I have tried. Could this be explained the same way? The site having some kind of DDoS protecting, or something alike, or because of the form being JS?

[d4rk_shadow]

well, I know what the problem is... Your're brute forcing https, so, That means facebook can easily detect you... I suggest to try brute force on facebook's xmpp service.

Ive got a script which bruteforce that service (Hydra for some reason doesn't work) if you need it send a pm

[rrdein]

Thank you very much for your response. There's just one thing that's annoying me. Your explaination seems to explain why it wont work on Facebook, however, this haven't worked on any site I have tried. Could this be explained the same way? The site having some kind of DDoS protecting, or something alike, or because of the form being JS?

Yessir, this can almost definitely be explained the same way. Almost any site will have that protection that I described. Most people have their sites running on a public web host, and all of those web hosts have DOS and brute force security at several levels. Running Hydra is essentially the same as launching a DOS attack against a website for however long it runs.

[xSecurity]

i code BruteForce
[ instagram - twitter - facebook - outlook ]
work with tor service ..

link : github(dot)com/xSecur1ty/xSecTOR

use it and have fun

[spαcєmαn]

Question why use hydra over sentrymba ? Sentry can do almost any site

[Beigevenus]

Question why use hydra over sentrymba ? Sentry can do almost any site

I wasn't aware that software such as Sentrymba existed, I will go and check it out, thank you!

---

Yessir, this can almost definitely be explained the same way. Almost any site will have that protection that I described. Most people have their sites running on a public web host, and all of those web hosts have DOS and brute force security at several levels. Running Hydra is essentially the same as launching a DOS attack against a website for however long it runs.

Alright, thank you! You have been a huge help to me :D