Basically, you need to specify two things:
- Where the username and password go.
- How to determine success/failure of the request.
The first is accomplished with tokens like
^PASS^ in the URL where they are to be replaced by the usernames and passwords under test. The second is done by hydra by string matching against the returned page. You can either test for a failure condition, such as "Bad password", or a success condition, such as "logged in".
Here's an example:
hydra 127.0.0.1 http-form-get '/test/login.php?username=^USER^&password=^PASS^:Bad password'
You can also test for a cookie being set with
C=cookie_name or an HTTP header with
H=header_name in place of "Bad password" for the test condition for a successful login.
In case the login form uses POST, rather than GET, (as many do) you should use the http-form-post "protocol". You'll also need to use
: to separate the URL and the POST parameters, rather than the
? in a query string. There's also https variations, which are (unsurprisingly) prefixed with
https-, rather than