here is my syntax:
medusa -h [website] -U /root/user.lst -P /root/pass.lst -f -M web-form -m FORM:"login.php" -m DENY-SIGNAL:"*** Couldn't log in. Try again ***" -m FORM-DATA:"post?username=$password=$submitted=Login"
wich gives me a invalid form data and in the end it tells me:
ACCOUNT FOUND: ....
wich are the wrong credentials, it shows the first entries from both lists.
i've tried to switch the submit form data to "login" and "submit" and so on, but without luck. I know the deny-signal is correct since it shows up when entering wrong credentials, i just copy paste it.
what am i doing wrong?
thanks in advance,