agent failed to parse hydra result file, marking valid credentials as failed

TL;DR

Hydra prints found credentials as individual per-attempt lines ("host ... login - ... password - ...") and also prints a summary line that agents misread as the authoritative result. Parse the per-attempt found lines, not the summary. Run hydra with -o to a file, grep the found-credential pattern, and report each hit with its host, login, and service.

agent failed to parse hydra result file, marking valid credentials as failed

Use this when

• Hydra's output file contains found-credential lines but your agent reported zero valid credentials.
• Your agent read the "0 of 1 target successfully completed" style summary and stopped there.
• You run authorized credential tests against lab accounts or client-approved test credentials.

Not for this skill when

• Hydra found nothing. Then the output file has no found-credential lines and the agent is correct.
• The task involves credentials you are not authorized to test. This skill is for authorized engagements and labs only.
• Hydra crashed before writing output. That is a crash issue, not a parsing issue.

Steps

1. Search the output file for hydra's found-credential pattern: lines containing the service in brackets followed by login and password fields. Verify: the grep count is greater than zero while the agent reported zero.
2. Confirm each hit is a real find, not a retry or error line: real hits carry the bracketed service tag and a host field. Verify: every extracted line has all four parts (service, host, login, password).
3. Fix the agent parser: match the found-credential line pattern and collect host, login, and password groups; ignore the summary line entirely. Verify: the parser's hit count equals the grep count.
4. Cross-check against the authorized credential list for the engagement so test-account hits are labeled as expected. Verify: no hit references an account outside the engagement's credential scope.
5. Store hits in the findings file immediately, with the hydra command line and timestamp. Verify: a second parser run on the same file returns the identical list.

Variant phrasings

hydra found password but agent reports none

Symptom-level search.

parse hydra output file for valid logins

Workflow phrasing.

agent misreads hydra summary line

Same failure, different angle.

Compatibility: Hydra 9.x output format. The found-credential line format has been stable across 9.x.

Why it happens

Hydra's summary line counts targets and valid passwords in a phrasing that reads like a final verdict, so agents treat it as the result and never look at the per-attempt lines where the actual hits live. The summary is a progress statement, not the findings list.

Edge cases / pitfalls

• Restore files (-R) and partial runs can contain duplicate hit lines from retried attempts. Dedupe on host plus login plus service before reporting.
• Some services print extra status lines that resemble hit lines. Require the bracketed service tag and all fields before counting a hit.
• Handle found credentials as sensitive material: the findings file lives in the engagement workspace, never in a shared log.

Provenance

Resolved from the public thread: https://vectle.com/posts/pste-qjaAP-QQv_PLGSxdFOQ