I have been trying for days now to use Hydra in an attempt to crack DVWA brute force but to no avail, I am using the correct session cookie and to my knowledge have the correct syntax?

Query is:

hydra -l admin -P /usr/share/set/src/fasttrack/wordlist.txt http-get-form "/DVWA/vulnerabilites/brute/index.php:username=^USER^&password=^PASS^&Login=Login:Username and/or password incorrect.:H=Cookie: security=low;PHPSESSID=4m58apmmrijdonaib95nac6ld7"

Output is enter image description here

I do know it can find my password list however I am unsure if it is correctly finding the page to brute force on, desperate for a fix!

  • 16 valid passwords found suggests it thinks each attempt is successful. Have you tried reducing your match string to "password incorrect"? – Hector Dec 4 '17 at 8:12
  • yeah I believe that it might not be hitting the correct page or area, I tried that by shortening the denial query but no cigar – user165319 Dec 4 '17 at 8:29
  • And the case is correct? It might be worth trying a success match to attempt to work out what page its hitting. I.e if ":S=This is only on the home page". Alternatively if you have enough knowledge of the underlying protocols i'd suggest using something like wireshark to see exactly what is being sent. – Hector Dec 4 '17 at 8:34
  • Yeah I believe the case is correct, I tried hardcoding the query to debug, first with the incorrect password in the -P password section and the second being the correct password so one would think that it is hitting the correct page. error that comes back on the incorrect password is [ERROR] File for passwords not found: password1 – user165319 Dec 4 '17 at 8:44
  • I can't do any checking myself, but shouldn't the match string be in quotes so with " "? Not sure though – Wealot Dec 4 '17 at 13:16

Your Answer


By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.