The Burp Suite User Forum was discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Center. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTER DISCORD

HTTP brute force with hydra no results

El | Last updated: Jul 17, 2021 04:32PM UTC

I'm trying to solve a brute force login exercise (https://portswigger.net/web-security/authentication/password-based/lab-username-enumeration-via-subtly-different-responses) using hydra and I do not know what I'm doing wrong, the below hydra command returns false positives or none at all (depending how I modify the expression) hydra -L usernames.txt -P passwords.txt target-domain-name https-post-form "/login:username=^USER^&password=^PASS^:Invalid" -v Does using hydra with portswigger require some additional configuration ?

Uthman, PortSwigger Agent | Last updated: Jul 19, 2021 10:52AM UTC

Hi, Have you tried using the instructions in the solution provided instead of Hydra?

Th3Panda | Last updated: Jul 31, 2021 06:42PM UTC