Is there any way for hydra to understand the correct combination ^USER^ and ^PASS^ in a http-post-form authentication attack based on the length of the body response?

In Burpsuite you can look at the length and understand password and username.For username jack, the found password is 12345678 based on the different length of the response

So basically how can I set up hydra to look at the length parameter during a http-post-form?

1 Answer 1


I'm not sure if this is possible to do with Hydra, but I would recommend using ffuf for this.

You can do an HTTP-POST form bruteforce based on length like this:

ffuf -w /path/to/wordlist.txt -X POST -d "username=admin\&password=FUZZ" -u https://target/login.php -fl 480

-fl: tells it to filter out the length you don't want (failed attempt) FUZZ: is where it will replace words from the wordlist in the request

Although in this approach the username would be static. A little bash scripting hack would solve that.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .