Hydra Guide: Network Login Cracking Tool

Why You Need Hydra

You have discovered an open SSH or FTP port — now you need to test whether weak credentials can access it. Hydra is the fastest parallelized network login cracker for attacking authentication protocols. It supports SSH, FTP, HTTP, SMB, RDP, VNC, and dozens more, making it the go-to tool for credential testing in authorized penetration tests.

Prerequisites

Before using Hydra, you should be comfortable with:

How Hydra Works

Hydra operates by establishing parallel network connections to a target service and attempting authentication using provided username and password lists. It supports multiple attack methods including:

Dictionary Attack: Uses a wordlist of common passwords against known usernames. This is the most common approach.

Brute Force Attack: Tries every possible combination of characters within defined parameters. This is computationally expensive but exhaustive.

Username Brute Force: Tries multiple usernames against a single password, useful for identifying valid accounts.

Installation

Hydra comes pre-installed on Kali Linux. For other distributions:

# Debian/Ubuntu
sudo apt install hydra

# Arch Linux
sudo pacman -S hydra

# macOS with Homebrew
brew install hydra

# From source
git clone https://github.com/vanhauser-thc/thc-hydra.git
cd thc-hydra
./configure
make
sudo make install

Basic Usage

The basic syntax for Hydra is:

hydra -l username -P passwordlist.txt service://target

Key Options

| Option | Description |

|--------|-------------|

| -l username | Single username to test |

| -L userlist.txt | File containing multiple usernames |

| -p password | Single password to test |

| -P passwordlist.txt | File containing multiple passwords |

| -t tasks | Number of parallel connections (default 16) |

| -s port | Specify non-default port |

| -vV | Verbose output showing login attempts |

| -f | Stop after finding first valid pair |

| -o output.txt | Save results to file |

Protocol-Specific Examples

SSH Authentication Testing

hydra -l root -P /usr/share/wordlists/rockyou.txt ssh://192.168.1.100

This attempts to log into SSH as root using passwords from the rockyou wordlist. SSH is rate-limited by default on most systems, so this may trigger security alerts.

FTP Authentication Testing

hydra -L users.txt -P /usr/share/wordlists/rockyou.txt ftp://192.168.1.100

Tests multiple usernames from users.txt against the FTP service. FTP sends credentials in plaintext, making it a common target.

HTTP POST Form Attack

hydra -l admin -P passwords.txt 192.168.1.100 http-post-form "/login.php:user=^USER^&pass=^PASS^:F=incorrect"

This attacks a web login form. The format is: "page:parameters:fail_string". The ^USER^ and ^PASS^ placeholders are replaced with the current attempt. The fail string indicates a failed login attempt.

RDP Authentication Testing

hydra -l administrator -P passwords.txt rdp://192.168.1.100

Tests RDP (Remote Desktop Protocol) authentication. RDP attacks are noisy and likely to trigger Windows security logs and account lockouts.

SMB Authentication Testing

hydra -l administrator -P passwords.txt smb://192.168.1.100

Tests SMB authentication on Windows file shares. Modern Windows systems have account lockout policies that limit the number of failed attempts.

MySQL Database Testing

hydra -l root -P passwords.txt mysql://192.168.1.100

HTTP GET Authentication

hydra -l admin -P passwords.txt 192.168.1.100 http-get "/admin"

Real-World Example: Full Assessment

# Step 1: Scan for open services
nmap -sS -sV -p- 192.168.1.100

# Step 2: Identify SSH and test common credentials
hydra -l root -P /usr/share/wordlists/rockyou.txt ssh://192.168.1.100 -t 4 -vV

# Step 3: Check FTP with known credentials list
hydra -L users.txt -P /usr/share/wordlists/rockyou.txt ftp://192.168.1.100 -t 8

# Step 4: Test HTTP admin panel
hydra -l admin -P passwords.txt 192.168.1.100 http-post-form "/login.php:user=^USER^&pass=^PASS^:F=incorrect" -f

# Step 5: Save all results
hydra -l root -P passwords.txt ssh://192.168.1.100 -o hydra-results.txt

{@visual hydra-brute-force-output}

Common Mistakes

Too Many Parallel Connections

Using the default -t 16 against a target with rate limiting will trigger account lockouts and IDS alerts. Start with -t 4 and increase gradually.

Ignoring Account Lockouts

Many services have account lockout policies after a certain number of failed attempts. Using -f to stop on first success is critical to avoid locking out legitimate users.

Wrong Protocol Syntax

Each protocol in Hydra has a slightly different syntax. Always check the help output before starting.

Not Using Target Lists

Attempting every service on every host without prioritization wastes time. Use Nmap output to identify services first.

Forgetting Wordlist Location

Kali Linux stores wordlists at /usr/share/wordlists/. Common lists include rockyou.txt.

Best Practices

Always start slow: Begin with -t 1 or -t 4 to understand the target's behavior and rate limits.

Use targeted wordlists: Custom wordlists generated with CeWL from a target's website are more effective than generic lists.

Implement account lockout awareness: Check the target's password policy before testing.

Combine with other tools: Use Nmap for service discovery, CeWL for custom wordlists, then Hydra.

Log everything: Always use -o to save results.

Related Tools

Related Articles

Summary

Hydra is a powerful, parallelized network login cracker essential for authentication security testing. It supports dozens of protocols and offers flexible attack configurations. Key takeaways include understanding protocol-specific syntax, respecting rate limits and account lockout policies, using targeted wordlists, and always testing with proper authorization.

Knowledge Check

References

{@ref kali-tools}

{@ref mitre-attack-credential-access}