[leszkens0990]

I need help
How to check POSTDATA (two variables responsible for success and failure) in login form?
i.e:.

hydra -vV -f -w 5 -l zapto123 -P /opt/premium/wordlist/mini.txt www.RANDOMSITE.cc http-post-form '/members/wp-login.php:log=^USER^&pwd=^PASS^&wp-submit.y=:14&redirect_to=%2Fmembers'
i need to know how to recognize succes and failure. Acordin to this blog:
http://insidetrust.blogspot.com/2011/08/...k-web.html

For the parameters of the request, you can intercept and examine a normal login attempt with a web proxy (such as owasp-zap, webscarab or burpsuite) or use a browser plugin (such as tamperdata) or just look at the HTML form.

tamperdata should help. and this is what this extension shows me after failed login attemp:

unfortunately, my syntax, which i post above, doesn't work.
so please anybody who is into hydra/kali linux please help me.

[SIM-2645323]

To recognize success or failure you can check for a string that appears after a failed login attempt.
Let's say you login failed and a string appears saying something like "Invalid login",
you can add it so it becomes "/members/wp-login.php:log=^USER^&pwd=^PASS^:Invalid login"
You can also check for successful login string with :S=string

[leszkens0990]

To recognize success or failure you can check for a string that appears after a failed login attempt.
Let's say you login failed and a string appears saying something like "Invalid login",
you can add it so it becomes "/members/wp-login.php:log=^USER^&pwd=^PASS^:Invalid login"
You can also check for successful login string with :S=string

what if any string won't appear? only login box is shaking <lol>

---

does anybody knows how to help me?

[leszkens0990]

Ok let's make it clear, maybe my research will be usefull for somebody.
The shaking login box means that the site is running on wordpress. i used wpscan ok kali linux to scan this site and it showed all known vulns for this version of wordpress and tried to bruteforce admin panel (/wp-admin as default). This site refused my connection after ~80 logon tries. Also i installed wordpress on free hosting to check few things. Going to wpscan my site though and I will se if the connection refusing is hosting fault, or wordpress.
@edit
Ok now i'm sure it's hosting fault.