So when I do hydra -l Admin -P "rockyou.txt" -s 80 http-get / it doesn't work for me. It says all 16 passwords are valid, but none of them works. Can anyone help me with this? I tried googling and found others having this issue, but none of them were descriptive enough for me to resolve this. I'm using a D-Link DIR 655 router, and that's what I want to try to bruteforce, but all the passwords it tries are valid (16 for that matter).

  • If you are using the same "rockyou.txt" that I do, it contains over 14 million passwords, if you are only seeing 16 results then something is wrong.
    – Red_Shadow
    Aug 13 '14 at 18:46
  • Well its like so cause i saw someone saying that THC Hydra didnt find the Login and Password field where to try the brute force on, therefor it didnt get a fail response and said all passwords are correct, any idea? Aug 14 '14 at 20:18

I tried Hydra on an HTTP-POST web form and I kept getting false positives. After a lot of research and googling tutorials it turns out I did not identify the "failure response". When the login fails, the server replies with a failure response maybe a redirection or a string of text. I hope this points you in the right direction.

  • The failure condition is the one thing most people forget to do for Hydra.
    – schroeder
    Sep 16 '14 at 18:29

Not the answer you're looking for? Browse other questions tagged or ask your own question.