UNIX for Dummies Questions & Answers

Hi.

I downloaded THC-Hydra for testing. I'm running Hydra in DOS commandprompt under a Windows XP Home PC. I know this is a UNIX related forum, but the commands for Hydra are same as in UNIX. And there are more experienced people in the UNIX community. I tried in Ubuntu first, with VirtualBox, but couldn't get it to work. And no, i didn't just try it once, i was trying to solve the problems for hours but in the end i got tired, and saw that there was a windows version of the software(lazy me). Now i run Hydra in the commandprompt.

Anyway, I have problems with it. I want to test perform an attack threw https against a website. I tried http://www.habbo.se as an example(Swedish version of this very lame Sulake project). My bigger sister also forgot her password there, and registered with the wrong DOB information and I thought hopefully i can crack it(she knows her usrname).

I found this in the source on the site www.habbo.se code:

<form action="https://www.habbo.se/account/submit" method="post">

Then the execution of hydra.exe should look like this right?

Code:

hydra -L users.txt -P passwords.txt -O logs.txt http://www.habbo.se https-form-post -F "/account/submit:credentials.username=^USER^&credentials.password=^PASS^&login=Logga in:Felaktigt lösenord"

I don't know if i have to explain the commands because you probably have more experience than me, but this is what these lines do:

-L = List of usernames to enter in the credentials.username field. The username replaces ^USER^
-P = Same as -L but for passwords
-O = It's used if you want to store the correct founded password in a file.
https-form-post = I think the protocol should be https, because of login function is http://www.habbo.se/account/submit. If I'm wrong, maybe that is the problem. Form-post is used to send the data to the fields on the site. Same as when you login at a site.

The last line in the quotes "" tells hydra where the parameters/fields are on the site. I think i did it right there(i followed the readme file).


When i execute it with these settings, the commandprompt just reruns the hydra.exe file(wich prints the list of commands for hydra) and ignores these settings. No attack performed. Strange because if i got some feedback of the problem maybe i could solve it.

I've been trying to solve this problem for a long time now.

Oh, by the way. The site have limited login performs. When four performs has been made, the site gives a code to enter together with the username and password, like this:

4th try:
user:
password:

please enter the code of the picture:

Is there anyway to bypass this?

Really grateful for help. Sorry for my bad english grammar. English is not my mother tounge.

And I have been reading the rules, but if it is some more information you need to help me, just tell me.

https-form-post n'existe pas
utilise: http-form-post avec l'option -S (connection en SSL)