This question already has an answer here:

As in title. I'm testing my router security and I came up with problem.

hydra http-get-form "/:un=^USER^&pw=^PASS^:User Name or Password is incorrect." -L usernames -P passwords

usernames : admin

passwords : admin, root, toor, 1234, realpassword(correct one)

I get: 1 of 1 target successfully completed, 5 valid passwords found

Only realpassword is the correct one but Hydra says all of them are good.

When I go to, which is router page, cookie (I guess) from Hydra allows me to be logged in. Still, executing this command does not provide me password, only session.

Q: How can I find out what password is real?


I had to pick 'false response' which was visible for me but not from 'bad login' page source.

marked as duplicate by schroeder, Xander, TildalWave, Mark, Scott Pack Dec 31 '14 at 4:34

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • you didn't tell hydra what a failed password looked like – schroeder Dec 30 '14 at 19:25
  • "User Name or Password is incorrect." isn't enough? – Fred Dec 30 '14 at 20:16
  • 1
    Hydra will behave as you specify if it can't properly find that string. Double-check the string, syntax, case, etc. – schroeder Dec 30 '14 at 22:11