Ok so what im actually trying to do is to bruteforce my own account on some website just to check myself .

This is NOT for illegal steps or use , im trying to crack my OWN password , and im trying to get help to see what im doing wrong with the software.

the thing is , when im starting the bruteforce , it doesnt recognize the real password it just pass to the next password and in the end it gives me wrong passwords to my username. Sometimes it even gives like 3-4 kind of wrong passwords which is impossible.

I've tried in 2 ways , with terminal codes on blacktrack (hydra) and im also trying with Hydragtk a ready software for bruteforce.

I've tried planty of commands on terminal way , this is one of them :

hydra -l admin123 -P /root/Desktop/passwords -S 80 -V http-post-form

but no matter what command i use and no matter how much i change and play and add to the command it still gives me wrong passwords , anyone can help please?

closed as off-topic by AviD Jan 16 '14 at 15:26

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions asking us to break the security of a specific system for you are off-topic unless they demonstrate an understanding of the concepts involved and clearly identify a specific problem." – AviD
If this question can be reworded to fit the rules in the help center, please edit the question.


Depending on the jurisdiction, what you are doing may be illegal nonetheless, even if that is "your own account". Technically, what you do is an online dictionary attack, so it entails a lot of connections to the target server, which hardly is "normal and fair usage" of the resources of that server. You have an account on that server based on the tacit (or explicit) acceptance of some usage rules, that your attack attempt breaks. To make an analogy: if you rent a safe box in a bank, then bring to the bank an industrial driller and begin to pierce the safe door, the banks may call the cops, even if that is "your" safe box.

Therefore caution is advisable. To make tests without incurring any legal inconvenience, I suggest that you run your own server as a virtual machine on your own PC.

In any case, what THC-HYDRA does is that it submits potential login+password pairs to a given Web server through POST requests -- and it must be able to determine whether the attempt succeeded or failed. At the HTTP level, the response code will always be a 200 (an "OK" code)(that's the whole difference between "HTTP Basic Authentication" and "HTTP form-based authentication"); the tool must somehow "understand" the returned Web page, which necessarily entails some heuristic analysis (the Web page which says "sorry, bad password" is meant for a human being, not for a machine). I suppose that whatever heuristics are applied by default by Hydra do not work well (or at all) for the site you are targeting. Maybe after a dozen attempts, the site returns another error page (no longer "sorry, bad password" but something like "begone, evil hacker !") which is misinterpreted by Hydra into a success report. This would explain what you observe (wrong passwords returned).

If the dialog with the server uses plain HTTP (not HTTPS), then you can observe the requests and responses with a network monitor tool like Wireshark. Otherwise, refer to the Hydra documentation to see how to configure it for response recognition.

  • Thanks for the answer, actually i didnt understand ALL of what you said but . I tried new site , and im still getting wrong password. Can anybody check this site and see if theres some protection or im doing something wrong? The site is : Maple.extalia.net its some game site . Another thing i forgot to mention , the site blocks you for 30 minuts after 5 bad login attempts . But i still dont know what to do and how to make my brute force working and giving the correct password – ram Jan 15 '14 at 19:26
  • 1
    @ram what you do is illigal. maple.extalia.net is not yours. Nobody will help you. – Stolas Jan 16 '14 at 15:22
  • @Stolas im not talking about the website in speciphic way im just trying to figure out why im getting wrong passwords everytime im trying to brute force some of my accounts in different sites. – ram Jan 16 '14 at 19:14

Not the answer you're looking for? Browse other questions tagged or ask your own question.