I want to test some mechanisms of my website when the password of a single user is entered a lot of times in a short time incorrectly in the login form. Therefore I got Hydra (for windows) on GitHub.

I have the following information:

  • Host: (as I test locally)
  • Method: https-form-post (as the site uses HTTPS)
  • URL: /login
  • Parameters for the form: username=admin, password=from the password list, submit_login (boolean)
  • I want to use a password file (password.txt)

When the login doesn't work, a page is shown, which html title is "Failed login" - however I'm not sure how to tell this to Hydra.

So I tried the following but get the result that all passwords work:

hydra -l admin -P password.txt https-post-form "/login:username=^USER^&password=^PASS^&submit_login&Login:Failed login"

I also tried the "success" version with S=Welcome back ... then the correct password isn't identified as correct.

Where is my error?


Try if it works this way:

hydra -l admin -P password.txt https-post-form "/login:username=^USER^&password=^PASS^:Failed"
  • 15
    It would be helpful if you could explain why. – AndrolGenhald Aug 6 '18 at 17:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.