I've been trying to use hydra (educational way) but with no success. The site method is http-post but performed by ajax (should it be a problem? I think not). After execute the command I got an output of passwords and username that allegedly valid. I saw that some people have asked about the reason for hydra giving wrong passwords and usernames and the answer was that the command should include the PHPSESSID. So I've been trying to use PHPSESSID but nothing changes.
hydra -L id.txt -P id.txt -s 80 -f 18.104.22.168 http-post-form "/Login/ajax/user-login.php:data=username=^USER^&password=^Pass^&remember=off&returnpath=:Fail :H=Cookie: security=low;PHPSESSID=9adriqaprd8f1qgot3ia1k3"
Any suggestions for the wrong passwords?