"dvwa" generates a new CSRF token for each each response. This is how CSRF protection should work. Where as in your script you extract it only once. Thus only your first request from "hydra" uses a correct CSRF token. All subsequent requests use an outdated CSRF token.

"dvwa" generates a new CSRF token for each each response. This is how CSRF protection should work. Where as in your script you extract it only once. Thus only your first request from "hydra" uses a correct CSRF token. All subsequent requests use an outdated CSRF token.

What can you do? Use some other tool, e.g. potator. Or create your own script in Python. The latter will have an advantage, that you will learn a lot about security in web applications.