This question already has an answer here:

So when I do hydra -l Admin -P "rockyou.txt" -s 80 192.168.13.1 http-get / it doesn't work for me. It says all 16 passwords are valid, but none of them works. Can anyone help me with this? I tried googling and found others having this issue, but none of them were descriptive enough for me to resolve this. I'm using a D-Link DIR 655 router, and that's what I want to try to bruteforce, but all the passwords it tries are valid (16 for that matter).

marked as duplicate by Xander, schroeder, TildalWave, Gilles, Graham Hill Sep 17 '14 at 10:26

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • If you are using the same "rockyou.txt" that I do, it contains over 14 million passwords, if you are only seeing 16 results then something is wrong. – Red_Shadow Aug 13 '14 at 18:46
  • Well its like so cause i saw someone saying that THC Hydra didnt find the Login and Password field where to try the brute force on, therefor it didnt get a fail response and said all passwords are correct, any idea? – Yannic Schwarz Aug 14 '14 at 20:18

I tried Hydra on an HTTP-POST web form and I kept getting false positives. After a lot of research and googling tutorials it turns out I did not identify the "failure response". When the login fails, the server replies with a failure response maybe a redirection or a string of text. I hope this points you in the right direction.

  • The failure condition is the one thing most people forget to do for Hydra. – schroeder Sep 16 '14 at 18:29

Not the answer you're looking for? Browse other questions tagged or ask your own question.