Problem: Hydra keeps giving me incorrect passwords every time. I'm using brute-force via Hydra to guess the correct password on a certain website.

First of all I used BurpSuite to intercept the page request:

POST /abcdefg/ HTTP/1.1
Host: localhost:2000 
User-Agent: Mozilla/5.0 (X11; Linux i686; rv:22.0) Gecko/20100101 Firefox/22.0 Iceweasel/22.0 
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 
Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Referer: http://localhost:2000/abcdefg/ Connection: keep-alive Content-Type: application/x-www-form-urlencoded Content-Length: 23 


I am using these parameters for the command-line:

hydra -f -v -V -s 2000 http-post-form -l admin -P /documents/pass.txt "/abcdefg/:pass=^PASS^:incorrect password"
  1. Host = ( I know I can also try with localhost)
  2. Port = 2000 (My local computer is listening for HTTP at port 2000)
  3. Method = http-post-form
  4. URL = /abcdefg/
  5. Form parameters = pass=^PASS^
  6. Failure response = incorrect password. When I click submit, the page reloads with the same URL, but with only the text 'incorrect password' on screen.
  7. User = admin
  8. Password file = pass.txt

The page source of the login page:

        <form action="./" method="post">
        username <input type="text" name="usr"></br>
        password <input type="password" name="pass"></br>
        <input type="submit" value="Submit">

The page source of the 'incorrect password' page:


<br>incorrect password

Please take a look at all the parameters to make sure I am using the right commands.

I have also taken a look at this question: Why does Hydra return 16 valid passwords when none are valid? which suggests checking the page cookies, but the webpage I'm trying to brute force into does not use cookies, so I think that is irrelevant?

1 Answer 1



"/abcdefg/:pass=^PASS^:incorrect password" be set to

"/:usr=^USER^&pass=^PASS^:incorrect password"

to match your form action as <form action="./" and username input as <input type="text" name="usr">?

  • Oh, I thought it's okay to leave that one out since I want Hydra to only test the password field, but thinking again, it makes sense to include the use field. Isn't the format supposed to be "URL_of_the_page:input fields:failure message"? I used "/abcdefg/:usr=^USER^&pass=^PASS^:incorrect password" This seems to do the trick! Thanks! Nov 25, 2013 at 14:12

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .