[ladderchair]

I am attempting a dictionary attack on instagram and I am using burpsuite.
So I am using this:
hydra -l (user) -P /root/rockyou.txt 31.13.66.52 http-post-form "accounts/login/ajax:username:username=^USER^:password=^PASS^:login=?" -V

I am not sure what I should use for the login failure message. It doesn't seem to show in burp suite.

[Gee4rce]

Are you sure there is no change to the website at all after a failed login?
You should look into the source, if there really is nothing on the page that changes-
even if it does not have to do with the login process, what you want is atleast a
3 - 4 char unique string that you can use for the pattern matching.

If that fails, here is option 2:
Create an account and see what you response you get after login.
Then you tell hydra that it shall not look for failed messages, and intead check for messages like "logged in", "access" or "success".

Hope this helped. Cheers, Gee.