I am trying to brute force an HTTP login form via Hydra.
The problem I am having is in regards to the response code returned by the page. I am receiving false positives on every password.
Even failed logins return HTTP 200 responses, which I believe is leading to false positives.
How can I alter hydra to look for something like content-length header or a unique string returned to avoid the false positives?