SOLUTION: I cannot crack a password for gmail/hotmail/outlook365/...

[vanhauser-thc]

ALL email services have password cracking protection enable, either blocking offender's IP addresses, faking positive results for bad passwords or faking negative results for a correct password.

Also hydra is telling the mail server that it is a password cracking tool to prevent misuse.

So if you test your own gmail/hotmail/... user account hydra will very likely tell you that the password is wrong.
But it is not hydra that is wrong, it is the mail server detecting an attack attempt and giving a fake reply.

[ImKool-Gitch]

how to fix this ?

[vanhauser-thc]

Maybe this could be fixed but I never will because that would be - except for very rare circumstances - an illegal usage of the tool. And for these rare circumstances the person hired to perform the authorized penetration would be highly skilled and can easily make the necessary changes.

[e2002e]

I had found out (and it was still true two years ago) that gmail can be tested with pop3s://smtp.gmail.com

[wendy565]

quiero recuperar la contraseña de mi gmail y de mi facebook pero no me acuerdo cual eran

[ChillVibesMushroom]

quiero recuperar la contraseña de mi gmail y de mi facebook pero no me acuerdo cual eran

Que es tu correo electronico

[Rimmmm44]

Hii guys I want to find password of instagram and I realy don't know how

[XenonPy]

@vanhauser-thc Just curious, how is the password cracker indicated? Is there a standard header for this, or does it vary by platform?

[sadab82984529]

gmail/hotmail/outlook365

[XenonPy]

@david121-ui script kiddie go brrrr

[wendy565]

Nzjfnzz El mar, 4 de mar de 2025, 4:47 p. m., XenonPy ***@***.***> escribió:

…

@david121-ui <https://github.com/david121-ui> script kiddie go brrrr — Reply to this email directly, view it on GitHub <#613 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/A6XGRTQGWGIIQ74VCUMRJSD2SYUQXAVCNFSM6AAAAABTQXCPY2VHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDMOJZGE2TCOBXHA> . You are receiving this because you commented.Message ID: ***@***.***> [image: XenonPy]*XenonPy* left a comment (vanhauser-thc/thc-hydra#613) <#613 (comment)> @david121-ui <https://github.com/david121-ui> script kiddie go brrrr — Reply to this email directly, view it on GitHub <#613 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/A6XGRTQGWGIIQ74VCUMRJSD2SYUQXAVCNFSM6AAAAABTQXCPY2VHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDMOJZGE2TCOBXHA> . You are receiving this because you commented.Message ID: ***@***.***>

[bakunjin]

thc-hydra doesn't do its job for which it is created.
I tried to hack my gmail with correct password, no chance. I tried dark web crimi market which has captcha page and hydra redirect from login page to captcha page. when it is not redirecting, it gives many times wrong password. and some websites have different name for login and password field, it is not so easy to find it, if you want to use hydra you must learn how to use burpsuite.

[vanhauser-thc]

@vanhauser-thc Just curious, how is the password cracker indicated? Is there a standard header for this, or does it vary by platform?

hydra sends a specific identification :)
but most providers just enable extra security after a few failed logins for an account.