I've been trying to use hydra (educational way) but with no success. The site method is http-post but performed by ajax (should it be a problem? I think not). After execute the command I got an output of passwords and username that allegedly valid. I saw that some people have asked about the reason for hydra giving wrong passwords and usernames and the answer was that the command should include the PHPSESSID. So I've been trying to use PHPSESSID but nothing changes.

the command:

hydra -L id.txt -P id.txt -s 80 -f http-post-form "/Login/ajax/user-login.php:data=username=^USER^&password=^Pass^&remember=off&returnpath=:Fail :H=Cookie: security=low;PHPSESSID=9adriqaprd8f1qgot3ia1k3"

Any suggestions for the wrong passwords?

  • You need more information about the page you're attacking. Try a manual test with curl or so, and see if the page actually sends "Fail " (with space) back to you, which is what you are searching for.
    – ndrix
    Feb 20, 2014 at 12:41
  • Are you trying that on Damn Vulnerable Web Application (DVWA) ?
    – ack__
    Feb 21, 2014 at 12:41
  • First of all, thanks for reply. -It doesn't send fail at all. -No, I'm using kali-linux.
    – user40118
    Feb 21, 2014 at 15:17

1 Answer 1


The way that Hydra determines if an attempt was successful or not is by comparing strings found in successful and unsuccessful return pages.

in your scenario i am assuming that the application is returning Fail if the attempt is not successful and something else if it is. if the page is blank in both cases that means all the attempts will be considered successful.

you should find a unique string in the return page (or page source) and put it after the :

more information here


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .