https-form-post stops after first found about thc-hydra HOT 4 CLOSED

Hi!

well, you are trying to do achieve something that is not what it was planned for :-)
however you did it wrong. try this:
create a list of potential usernames (here: the numbers of length 5-7) and save it as usernames.txt
then run hydra:
hydra https-form-post ":username=^USER^&password=^PASS^&login-form-type=pwd&returnLocation=index.html:Not found" -L usernames.txt -p badpass -v -o userIDs.txt -t 10

from thc-hydra.

That would certainly work, but I wanted to leave as small a footprint on the machine as possible, so I was using the password generation capabilities for the IDs. If this isn't a bug (since -f is supposed to make it stop at the first confirmed login, and without it, it shouldn't stop), then it might be good to state that somewhere in the hydra -U https-form-post.

from thc-hydra.

the -f option results that ALL attempts on ANY account are terminated once one password is found for ANY account. so the -f option will make what you want unfeasible :-)
I you want to leave a small footprint on the machine I hope what you do is legal ... ...

from thc-hydra.

Ah, gotcha. Thats good to know.

And yes, I am a security consultant doing a few pentests. This was the first time I had to do user id enumeration like this, and I couldn't figure out why hydra wasn't playing well. Thanks for the clarification

from thc-hydra.