I am using THC Hydra (v9.0) on GNU/Linux to pentest my private API.

The GET route in question requires a key as GET parameter which returns an auth token if the correct key was submitted else "false".
If no key or a wrong key is submitted, the route returns always "false" for the next 5 seconds, even if the correct key is submitted.

(Please do not comment the way the API works, this is not the question)

Even when providing the correct key to Hydra, it returns "false". When executing Hydra with -d it shows me that before the actual request with the key as parameter is sent, it sends a request without any parameters.

Why does Hydra do this and can I prevent it?

This cannot be due to the HTTP request because with other tools like curl or Postman, it immediately sends the request with the parameter.

  • See this post.
    – user
    Sep 29, 2021 at 15:14
  • There appears to be an option to disable that function in hydra-http-form.c ((g|G)= skip pre-requests - only use this when no pre-cookies are required). If that's the module you're using you may have luck with that option.
    – user
    Sep 29, 2021 at 15:23
  • @user Please don't post answers as comments.
    – user163495
    Sep 29, 2021 at 18:33
  • @MechMK1 I do not have THC Hydra, so I don't know if that even answers the question.
    – user
    Sep 29, 2021 at 19:06

1 Answer 1


Like @user said in the comments, Hydra does this pre request to get the inital cookies of the webpage.

You can set another webpage for the pre-request with c= as optional parameter after the check condition like so:
hydra -l user -p pass http-get-form "/api/route/:password=^PASS^:false:c="

This way hydra does not use the actual route to fetch the cookies and my problem is solved.


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .