Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

How do I have to use hydra on a web form?

What I have done so far:
I already successfully used hydra on a folder with an HTTP authentication:


with user admin and password 1234, I successfully found out the password with:

hydra -l admin -x 1:5:1 -t 1 -f -vV http-get /test/authtest/

But how would I have to try a run on a web form like
share|improve this question

closed as unclear what you're asking by schroeder, Adi, Xander, AJ Henderson, Iszi Jun 11 '14 at 18:50

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question.If this question can be reworded to fit the rules in the help center, please edit the question.

Are you trying to access the folder contents, or be validated by the login page? What does the folder have to do with your scenario. – schroeder Jun 11 '14 at 3:31
The folder is another test I successfully managed before. Now I try to find the right way to solve such task with a form that awaits the user and password as POST data – rubo77 Jun 11 '14 at 6:20
So the folder has nothing to do with your question? You're really asking how to use hydra on a login page? – schroeder Jun 11 '14 at 14:05
No, I clarified my question. The correct answer is already there, by David – rubo77 Jun 11 '14 at 16:01
up vote 5 down vote accepted

Basically, you need to specify two things:

  1. Where the username and password go.
  2. How to determine success/failure of the request.

The first is accomplished with tokens like ^USER^ and ^PASS^ in the URL where they are to be replaced by the usernames and passwords under test. The second is done by hydra by string matching against the returned page. You can either test for a failure condition, such as "Bad password", or a success condition, such as "logged in".

Here's an example:

hydra http-form-get '/test/login.php?username=^USER^&password=^PASS^:Bad password'

You can also test for a cookie being set with C=cookie_name or an HTTP header with H=header_name in place of "Bad password" for the test condition for a successful login.

In case the login form uses POST, rather than GET, (as many do) you should use the http-form-post "protocol". You'll also need to use : to separate the URL and the POST parameters, rather than the ? in a query string. There's also https variations, which are (unsurprisingly) prefixed with https-, rather than http-.

share|improve this answer
I get an error when I try this: hydra -l admin -x 1:8:1 -t 1 -f -vV http-form-post '/login.php?username=^USER^&password=^PASS^:Bad password' The Error is: [ERROR] the variables argument needs at least the strings ^USER^ or ^PASS^: Bad password – rubo77 Jun 11 '14 at 6:29
Modified to clarify the answer, but TL;DR is separate post variables with a :. For example 'login.php:username=^USER^&password=^PASS^:Bad password'. – David Jun 11 '14 at 6:33
Thanks that worked, maybe you add my example for a post form and auto generation of passwords from 0 up to 99999999 to your post – rubo77 Jun 11 '14 at 6:35
I am getting false positives. I guess due to the fast rate of requests sometimes my server doesn't deliver the whole page and the part with "Bad password" is missing, so hydra thinks the password worked. Shouldn't hydra verify the password before stopping? – rubo77 Jun 11 '14 at 7:54
Consider using "S=Good Password" instead, so it will look for an affirmative response. Though then you might get false negatives if an error occurs on a valid password. – David Jun 11 '14 at 14:20

Not the answer you're looking for? Browse other questions tagged or ask your own question.