This question already has an answer here:
I am trying to penetrate a password on my own website using hydra. Let's say that I know login and password and i just put both there like in sample below:
hydra -l admin -p password 18.104.22.168 http-form-post "/index.php:userinput=^USER^&passwordinput=^PASS^:password is wrong"
After attack like this, hydra says that all the passwords are correct even if i put a wrong one... I think the last part might be wrong but my website says "password is wrong" when i fail to login. So what is the problem then?
EDIT: In addition, when i change
:password is wrong
:S=password is correct
It this time gives me always falses. No matter if I give a correct one or not. How do i understand that?
EDIT NEW: I have logged in on website and added the cookie to the code: