I am trying to brute force an HTTP login form via Hydra.

The problem I am having is in regards to the response code returned by the page. I am receiving false positives on every password.

Even failed logins return HTTP 200 responses, which I believe is leading to false positives.

How can I alter hydra to look for something like content-length header or a unique string returned to avoid the false positives?

  • in the hydra command you use, you specify what hydra is to look for to determine if the login was successful
    – schroeder
    Jul 17, 2018 at 15:11
  • @schroeder unfortunately i do not know what success looks like. I just know if it fails, what html is rendered
    – Hysii
    Jul 17, 2018 at 15:17
  • 2
    Then the problem is not the 200 response, but your understanding of the system.
    – schroeder
    Jul 17, 2018 at 15:29

1 Answer 1


Getting a 200 response is fine. You need to tell Hydra what to look for in the response page.

For example, if I log into SocialSite.com/login.php and my creds are wrong, the login page will return with a message of Bad username or password!

You can do this by adding some of this text to the end of your hydra command

hydra http-form-post "socialsite.com/login.php:user=^USER^&pass=^PASS^:Bad username" ...

notice at the end of the http-form-post arg there's :Bad username" That tells hydra to look for that text in the response.

Here's a full example for you to reference

  • I did this, as entering poor credentials renders a tag that says "Login Error". So, exactly as you did, added Login Error at the end....and I am still getting false positives :(
    – Hysii
    Jul 17, 2018 at 15:26
  • 1
    @Hysii I would look more at what you're doing then because this is the answer. Maybe there's a piece of the picture you're missing Jul 17, 2018 at 15:26
  • Possibly locked accounts or rate limiting is changing the page output, you can always run hydra via a proxy like burp and verify.
    – wireghoul
    Feb 14, 2022 at 2:43

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .