By Tyler O’Hare
Prerequisites: Before we get in to using hydra you need to have a few things set up. First you will need a virtual machine that uses Kali Linux as its operating system.
- First we are going to use Burp Suite to collect information about the login. Open Burp Suite and make a new temporary project.
- Head over to the “Proxy” tab and make sure Intercept is on.
- Select the options tab and make sure that it looks like this:
- Now open up Firefox and go to your preferences>advanced>network>settings and change the HTTP Proxy to 127.0.0.1 on port 8080 and make sure you remove 127.0.0.1 under “No proxy for”.
- Save it and exit out of your preference tab. Head over to DVWA and make sure you have the brute force tab open.
- Type in a random Username and Password it doesn’t matter if its right and press enter. For this example I will use ‘hello’ as a User and ‘there’ as a password.
When you go to burpsuite you should see a message that looks like this:
copy all of this data to a text document you’ll need some of it later.
- Open up a terminal and type: hydra 127.0.0.1 -V -l (username) -P (Path to your password list) http-get-form “/(Name of your DVWA folder)/vulnerabilities/brute/:username=^USER^&password=^PASS^&Login:F=incorrect:H=Cookie PHPSESSID=(Your php session id that you captured in burpsuite); security=low”
//Make sure you substitute the parenthesis with your own data and paths!!!
Color guide:
Yellow: This is the url of the brute force login page.
Using the data I gathered I was able to craft this:
- Press enter and you should get an output similar to this:
- Make sure your syntax is correct because hydra tends to be very picky.
- You have successfully cracked DVWA’s login using hydra! Great job!