Ready to Start Your Career?

Getting Web Form Online Passwords With THC-Hydra & Burp Suite

By: shahinnishad

June 5, 2018

What Is THC-Hydra?

Hydra is a parallelized login cracker which supports numerous protocols to attack. It is very fast and flexible, and new modules are easy to add. This tool makes it possible for researchers and security consultants to show how easy it would be to gain unauthorized access to a system remotely.

This tutorial is for educational purposes only and should not be used for any illegal activities. I'M NOT RESPONSIBLE IF YOU CAUSE ANY DAMAGE OR MISUSE IT. Don’t INTRUDE into someone's privacy.

Step 1: Open Hydra

Fire up Kali and open THC-Hydra from Applications -> Kali Linux -> Password Attacks -> Online Attacks -> hydra.

Step 2: Get The Form Parameters

To be able to sneak into web form usernames and passwords, we need to determine the parameters of the web form login page, as well as how the form responds to bad/failed logins. The key parameters we must identify are the following:

IP address of the website
URL
Type of form
Field containing the username
Field containing the password
Failure message

We can identify each of these using a proxy, such as Tamper Data or Burp Suite.

Step 3(a): Using Burp Suite

It is also recommended to use Tamper Data, but in this tutorial, we will be using Burp Suite. You can open Burp Suite by going to Applications -> Kali Linux -> Web Applications -> Web Application Proxies -> Burp Suite. When you do, you should see the opening screen like the one below.

Step 3(b)

Now, we will be attempting to crack the password on the Damn Vulnerable Web Application (DVWA) (A Safe Testing environment). You can run it from the Metasploitable operating system (OS to Run Metasploit) here, and then connect to its login page, as I have here.

Now, we need to enable the Proxy and Intercept on the Burp Suite as done below. Make sure to click on the Proxy tab at the top and then Intercept on the second row of tabs. Make certain that the "Intercept is on."

Finally, we need to configure our IceWeasel web browser to use a proxy. We can do that by going to Edit -> Preferences -> Advanced -> Network -> Settings to open the Connection Settings, as seen below. There, configure IceWeasel to use 127.0.0.1 port 8080 as a proxy by typing in 127.0.0.1 in the HTTP Proxy field, 8080 in the Port field, and delete any information in the No Proxy for field at the bottom. Also, select the "Use this proxy server for all protocols" button.

Step 4: Getting the wrong response.

Now, let's try to log in with my username "hacker101" and password "funnyman." When doing that, the Burp Suite intercepts the request and shows us the key fields needed for a THC-Hydra web form crack.

After collecting the required information, I then forward the request from Burp Suite by hitting the "Forward" button to the far left. The DVWA returns a message that the "Login failed." Now, I have all the information I need to configure THC-Hydra to crack this web app.

Getting the failure message is key to getting THC-Hydra to work on web forms. In this case, it is a text-based message, but it won't always be. At times, it may be a cookie, but the critical part is finding out how the application communicates a failed login. In this way, we can tell THC-Hydra to keep trying different passwords; it's only when that message does not appear that we have succeeded.

Step 5: Entering The Parameters into Hydra Command

Now that we have the parameters, we can place them into the THC-Hydra command. The syntax looks like this:

kali > hydra -L <username list> -p <password list> <IP Address> <form parameters><failed login message>

So, based on the information we have gathered from Burp Suite, our command should look something like this:

kali >hydra -L <wordlist> -P<password list>192.168.1.101 http-post-form "/dvwa/login.php:username=^USER^&password=^PASS^&Login=Login:Login failed"

NOTE: If you use the upper case "L," then you are using a username list, and if lower case "l," then you are trying to crack one username that you supply there. In this case, I will be using the lower case "l," as I will only be trying to crack the "admin" password.

After the address of the login form (/dvwa/login.php), the next field is the name of the field that takes the username. In our case, it is "username," but on some forms, it might be something different, such as "login."

Now, let's crack this web form login.

Step 6: Choose a Wordlist.

Now, we need to choose a wordlist. As with any dictionary attack, the wordlist is key. You can use a custom one made with Crunch of CeWL, but Kali has numerous wordlists built right in. To see them all, simply type:

kali > locate wordlist

In addition, there are numerous online sites with wordlists that can be up to 100 GB! Choose wisely, my hacker novitiates. In this case, I will be using a built-in wordlist with less than 1,000 words at:

/usr/share/dirb/wordlists/short.txt

Step 7: Creating the Command.

Now, let's build our command with all of these elements, as seen below.

kali > hydra -l admin -P /usr/share/dirb/wordlists/small.txt 192.168.1.101 http-post-form "/dvwa/login.php:username=^USER^&password=^PASS^&Login=Login:Login failed" -V

Step 8: Fire Up Hydra!!!

Fire it up! Since we used the -V switch, THC-Hydra will show us every attempt.

After a few minutes, Hydra returns with the password for our web application.

Although THC-Hydra is an effective and excellent tool for online password cracking, when using it in web forms, it takes a bit of practice. The key to successfully using it in web forms is determining how the form responds to a failed login versus a successful login. In the example above, we identified the failed login message, but we could have identified the successful message and used that instead. To use the successful message, we would replace the failed login message with "S=successful message" such as this:

kali > hydra -l admin -P /usr/share/dirb/wordlists/small.txt 192.168.1.101 http-post-form "/dvwa/login.php:username=^USER^&password=^PASS^&S=success message" -V

Also, some web servers will notice many rapid failed attempts at logging in and lock you out. In this case, you will want to use the wait function in THC-Hydra. This will add a wait between attempts so as not to trigger the lockout. You can use this functionality with the -w switch, so we revise our command to wait 10 seconds between attempts by writing it:

kali > hydra -l admin -P /usr/share/dirb/wordlists/small.txt 192.168.1.101 http-post-form "/dvwa/login.php:username=^USER^&password=^PASS^&Login=Login:Login failed" -w 10 -V

I recommend that you practice the use of THC-Hydra on forms where you know the username and password before using it "out in the wild."

USEFUL KEY IDENTIFIERS:

-l indicates a single username (use -L for a username list)
-P indicates use the following password list
http-post-form indicates the type of form
/dvwa/login-php is the login page URL
username is the form field where the username is entered
^USER^ tells Hydra to use the username or list in the field
password is the form field where the password is entered (it may be passwd, pass, etc.)
^PASS^ tells Hydra to use the password list supplied
Login indicates to Hydra the login failed message
Login failed is the login failure message that the form returned
-V is for verbose output showing every attempt

HOPE YOU ENJOYED THE TUTORIAL!