Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have an issue with Hydra when I use it. I have tried the same command lines given in guides directly supported by the Damn Vulnerable Web Application (DVWA) v1.8.

Ok so.. here is my attempt output...

root@kali:~# hydra -l admin -P /wordlists/500-worst-passwords.txt
http-get-form "/DVWA-1.0.8/vulnerabilities/brute/index.php:username=^USER^&
password=^PASS^&submit=Login:Username and/or password incorrect." -f

Hydra v7.3 (c)2012 by van Hauser/THC & David Maciejak - for legal purposes only

Hydra ( starting at 2013-09-06 05:18:12
[DATA] 16 tasks, 1 server, 500 login tries (l:1/p:500), ~31 tries per task
[DATA] attacking service http-get-form on port 80
[80][www-form] host:   login: admin   password: shadow
[STATUS] attack finished for (valid pair found)
1 of 1 target successfuly completed, 1 valid password found
Hydra ( finished at 2013-09-06 05:18:12

Yes, its true that the HTML form method is GET. :O)

Ok so, regardless how many times I run the command I get different answers.. like..

Attempt 1

[80][www-form] host:   login: admin   password: 101193
[80][www-form] host:   login: admin   password: horse

Attempt 2

[80][www-form] host:   login: admin   password: carhorn
[80][www-form] host:   login: admin   password: shadowfox
[80][www-form] host:   login: admin   password: multible


hydra -l admin -P /wordlists/500-worst-passwords.txt http-get-form 
submit=Login:Username and/or password incorrect.:H=Cookie: security=high;

I tried to add the cookie phpsession id aswell. I also tried to put in the:

-t <tasks>

So far I have no success.

share|improve this question
I may add that, the password file that use do contain the correct password. I think its about line 20 or so its found in the file. – Daniel Sep 6 '13 at 9:36
hydra scans for "Username and/or password incorrect" to detect failed attempts in the answer. if this is not found, for whatever reasons, if thinx that login is OK. – that guy from over there Sep 6 '13 at 9:45
Thanks for your comment, but the output text is correct in my case :-). The output text the application makes is "Username and/or password incorrect." – Daniel Sep 6 '13 at 9:48
Let me add that i tried to set different failure attempts in aswell, as in parts of the failed text. – Daniel Sep 6 '13 at 9:51
the output-text is correct, thats not what i wanted to say. what i wanted to say is: what happens if the response is empty? or your server is overloaded and doesnt respond / respond with 403? i see the issue here with hydra, not beeing able to detect false positives. maybe you limit the concurrent-number of tests until you get valid results – that guy from over there Sep 6 '13 at 10:59

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.