Hack Your First Web App: Ep.6 - Hydra

Question

I am stuck on Question 7 which instructs you to use hydra to brute force a password. I was able to use it correctly on Ep. 5.

I have tried using the same cmd and changing to the login page but it returns 16 incorrect matches rather than one.

hydra -l test -P /usr/share/wordlists/custom/ozone-wordlist.txt ozone-energy.bitnet http-form-post"/login:username=^USER^&password=^PASS^&Login=Login:Invalid Password"

lewismutton · Answer

Almost there! Make sure that your failure string matches the response from the login form 😜

cybersharpe · Answer

sh5801​&nbsp;I agree with LewisMutton​&nbsp;. You almost have it.A quick scan using burp and entering incorrect creds allowed me to find the correct string for failed login.&nbsp;This is the only change you need to make to your syntax.Additionally, some vulnerable apps use weak or predictable passwords.&nbsp;Always worth a shot.If this works consider it solved ;)&nbsp;