I'm trying to bruteforce my own HTTPS website account through Hydra. Therefore, it is 100% legal. Hydra keeps producing tons of incorrect passwords.

This is the code I use:
hydra -v -V -l XXXXXX -x 6:6:a1 -f -v example.com http-get /user/login.php

Can anyone help?

  • http-get-form example: hydra -L users.txt -P words.txt www.site.com http-post-form "/index.cgi:login&name=^USER^&password=^PASS^&login=Login:Not allowed"
    – eof0100
    Commented Nov 26, 2015 at 22:44
  • 1
    it's only 100% legal if you have permission from the website owner
    – schroeder
    Commented Nov 26, 2015 at 23:43

3 Answers 3


I'm guessing you are trying to brute force a login form, sometimes with hydra cli you have to play with it editing number of threads, etc. Here is a good tutorial which explains all the GET/POST methods as well as using hydra on brute forcing and launching a dictionary attack.

Also you need to supply good password / bad password condition which are called tokens like ^USER^ and ^PASS^ in the URL where they are to be replaced by the usernames and passwords under test. The second is done by hydra by string matching against the returned page. You can either test for a failure condition, such as "Bad password", or a success condition, such as "logged in". If you don't supply the conditions how does hydra know what username:password combination is the correct one? You need to let hydra know what it means to login successfully and unsuccessfully, each website is different like "Bad Password" "Login Incorrect "Please Try Again". Here's a very simple command line example:

hydra http-form-get '/login.php?username=^USER^&password=^PASS^:Bad password'

Hydra Guide

PS: Also sometimes due to high number of threads the page doesn't have time to load giving you false positives always try to decrease thread count.

  • I slightly modified your code to hydra -v -V -t 1 -l XXXXXX -x 6:6:a1 example.com https-get-form "/user/login.php?:username=^USER^&password=^PASS^: Invalid username or password" Now I'm getting errors. [VERBOSE] Couldn't create SSL session: error 14077410:SSL routines:SSL23_GET_SERVER_HELLO:sslv3 alert handshake failure Commented Nov 27, 2015 at 19:42

You can try brutus. It's easier than hydra.

In order to perform a brute force attack, you need to understand the HTML source of the login page.

The correct field values must then be fed to your brute forcer of choice.


What THC-HYDRA does is that it submits potential login+password pairs to a given Web server through POST requests -- and it must be able to determine whether the attempt succeeded or failed. At the HTTP level, the response code will always be a 200 (an "OK" code)(that's the whole difference between "HTTP Basic Authentication" and "HTTP form-based authentication"); the tool must somehow "understand" the returned Web page, which necessarily entails some heuristic analysis (the Web page which says "sorry, bad password" is meant for a human being, not for a machine). I suppose that whatever heuristics are applied by default by Hydra do not work well (or at all) for the site you are targeting. Maybe after a dozen attempts, the site returns another error page (no longer "sorry, bad password" but something like "begone, evil hacker !") which is misinterpreted by Hydra into a success report. This would explain what you observe (wrong passwords returned).

If the dialog with the server uses plain HTTP (not HTTPS), then you can observe the requests and responses with a network monitor tool like Wireshark. Otherwise, refer to the Hydra documentation to see how to configure it for response recognition.

refer to this thread

  • What if the website uses HTTPS? How am I suppose to login? Commented Nov 27, 2015 at 12:14
  • Refer to eof0100 answer
    – Sanidhay
    Commented Nov 27, 2015 at 12:32

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .