[idsiaowooooo]

I have some usernames + partial passwords for a particular website, and would like to use HYDRA to get the full passwords and access the accounts.

But I've never used HYDRA so would appreciate a bit of mentoring, specifically:

1) Don't yet know the login and password form parameters
2) I don't want to set off any alarm bells on the site, so appreciate any advice on running HYDRA as "quietly" as possible.

Happy to pay for some sage advice, just need someone with experience of running HYDRA on web forms.

thanks

[xulas]

Hydra is a solid tool, but is more oriented towards protocol-based and service-based authentication cracking. For your purposes, something like Sentry MBA is a better fit. If you insist on using Hydra, it is perhaps better to chain it with proxychains-ng and setting a limiter on attempts per minute. That would make it less loud, but will ofcourse increase operation time.

With partial passwords, it is best to custom write a little script with pretuned bruteforce parameters to get results quickly. Easiest way is to use python.

[DSVR]

Tamperdata FF plugin will get you the post parameters. Or you can use an inline proxy like Burp.