Hydra

Run 'hydra -l <user> -P /usr/share/wordlists/rockyou.txt <target> <service>' where <target> is an IP you own. For example, test SSH on your lab machine: 'hydra -l admin -P wordlist.txt 10.10.10.10 ssh'. Hydra supports over 50 protocols including HTTP, FTP, RDP, SMB, and MySQL.

Use '-l <username>' for a single known username, or '-L users.txt' for a list. Use '-P passwords.txt' for a password list, or '-p <password>' for a single password. Combine with '-t 4' to limit threads and avoid account lockouts on authorized test accounts.

Use 'hydra -l admin -P wordlist.txt 10.10.10.10 http-post-form "/login:username=^USER^&password=^PASS^:F=incorrect"'. The ^USER^ and ^PASS^ placeholders are replaced with each candidate. The F= string identifies a failed login in the response body.

Run 'hydra -l root -P /usr/share/wordlists/rockyou.txt 10.10.10.10 ssh' against your lab machine. Hydra connects on port 22 by default. Add '-s 2222' for non-standard ports. Always test only against systems you own or have written authorization to test.

Yes, Hydra is free and open source. On Kali Linux, it is pre-installed or run 'sudo apt install hydra'. On Ubuntu/Debian: 'sudo apt install hydra'. From source, clone the GitHub repo and run 'make'. Hydra is maintained by van Hauser of THC.

THC-Hydra is the full name of Hydra, developed by the Hacker's Choice (THC) team. It is a network login cracker that supports 50+ protocols and uses parallelized connections for fast dictionary attacks. The tool is the industry standard for online password auditing during penetration tests.

THC Hydra is the de facto standard online login brute-forcer, supporting over 50 protocols including SSH, FTP, HTTP(S), RDP, SMB, and VNC. Unlike generic password testers, Hydra uses parallelized TCP connections to achieve thousands of authentication attempts per minute while maintaining per-protocol awareness of authentication mechanisms.

Use the http-post-form or http-get-form module with three colon-separated parts: the URL path, form field placeholders (^USER^ and ^PASS^), and a failure string. Example: hydra -l admin -P wordlist.txt target http-post-form '/login:user=^USER^&pass=^PASS^:F=incorrect' always works because the -F flag tells Hydra to compare server responses against the failure indicator.

Reduce thread count with -t 1 or -t 2, add delays between attempts with -w <seconds>, and use -f to stop immediately after the first valid credential. For production systems with lockout policies, sequence attacks with sleep intervals between batches and monitor authentication logs for lockout warnings.

Hydra excels when you need broad protocol coverage (50+ protocols) with HTTP form attack capabilities - it is the only major brute-forcer that handles custom web login forms. Choose Medusa for multi-host parallel scanning across a network, and Ncrack when you need native Nmap integration via -iX for seamless service discovery pipelines.

Hydra supports over 50 network protocols including SSH, FTP, HTTP(S), RDP, SMB, MySQL, PostgreSQL, VNC, SNMP, POP3, IMAP, LDAP, SIP, IKE, telnet, and many more. Run hydra -h to print the complete list of supported service modules with their exact module names (e.g., ssh, ftp, http-post-form).

For general testing, /usr/share/wordlists/rockyou.txt is the standard choice covering common password patterns. For targeted engagements, generate custom wordlists with CeWL (spidering the target's own website for context-specific terms) or combine company-specific terms with common passwords from SecLists. Focused lists of 500-2000 entries often outperform massive 14-million-entry lists.

Use the https-post-form or https-get-form module instead of the HTTP variants. When the target uses a self-signed certificate, add -S to disable certificate verification. Full command: hydra -l admin -P wordlist.txt target https-post-form '/login:user=^USER^&pass=^PASS^:F=failed' -S. Always verify certificate handling before starting large-scale attacks.

Combo files store pre-paired username:password values (one per line). Use the -C flag instead of separate -L and -P flags: hydra -C userpass.txt target ssh is faster because Hydra skips the Cartesian product of all username-password combinations and tests only known pairs. This is ideal for reusing credentials discovered during reconnaissance.

Use -M targets.txt with one IP per line: hydra -M targets.txt -l admin -P wordlist.txt ssh. Hydra attacks all targets in parallel, distributing threads across hosts. This is effective for network-wide credential auditing during internal penetration tests where you need to check the same credentials against multiple machines simultaneously.

The -e nsr flag enables three extra password checks in a single flag: 'n' tests null passwords (empty string), 's' tests the username itself as the password (same-as-username), and 'r' tests the reversed username. These patterns account for a significant percentage of weak credentials found in real-world assessments.

Use the http-post-form module against wp-login.php: hydra -l admin -P wordlist.txt target http-post-form '/wp-login.php:log=^USER^&pwd=^PASS^:F=incorrect'. First run WPScan user enumeration to discover valid usernames, then feed them to Hydra with -L users.txt for targeted attacks against discovered WordPress administrator accounts.

Hydra achieves 100-500 authentication attempts per second for SSH and FTP depending on thread count and network latency. HTTP form attacks are slower (10-50/sec) due to HTTP connection overhead and server-side session handling. This is 100-1000x faster than manual browser-based testing and 2-5x faster than most Python brute-forcers.

Hydra itself is legal open-source software. Using it requires explicit written authorization from the system owner before testing. Unauthorized brute-forcing violates the CFAA in the US, Computer Misuse Act in the UK, and equivalent laws worldwide - carrying criminal penalties including fines and imprisonment. Always operate within a signed scope of work.

Use -o results.txt to save results to a file, or -o results.json for machine-readable output. Use -b to append to existing files instead of overwriting. For reporting, parse the JSON output with jq to extract only successful logins: jq '.results[] | select(.status=="success")' results.json. Hydra logs every attempt with timestamps when using -V for verbose output.

Use the vnc module: hydra -P wordlist.txt target vnc. VNC uses a challenge-response authentication mechanism where username is typically not required - Hydra only needs to guess the password. The vnc module automatically handles RFB protocol negotiation, making it transparent to the user. VNC attacks are slower than SSH due to the graphic protocol overhead.

Use -e n to add null password testing to any attack: hydra -l admin -e n -P wordlist.txt target ssh. The full -e nsr flag combines null password, same-as-username, and reversed username checks in a single pass. These are especially effective against embedded systems, IoT devices, and legacy network appliances that ship with default credentials.

Yes, use the snmp module: hydra -P community.txt target snmp. SNMP brute-forcing tests common community strings (public, private, manager) against SNMP-enabled devices. SNMPv1/v2c transmit community strings in cleartext, making brute-force effective. Use snmpwalk after discovering valid strings to enumerate device information.

Hydra does not natively support SOCKS proxies. Route Hydra traffic through a proxy using proxychains: proxychains hydra -l admin -P wordlist.txt target ssh. Configure proxychains with your SOCKS5 proxy in /etc/proxychains.conf. This adds latency but anonymizes the source IP of brute-force attempts.

Yes, use the ftp module with an anonymous username: hydra -l anonymous -p "" target ftp. An anonymous FTP login test checks whether the server allows unauthenticated file access. Use -e nsr to also test null passwords and same-as-username checks. Combine with nmap -sV -p 21 to first verify FTP is running.

The -x flag enables brute-force mode where Hydra generates passwords from a character set instead of using a wordlist. Format: -x MIN:MAX:CHARSET. Example: -x 4:8:aA1 generates passwords 4-8 characters long using lowercase, uppercase, and digits. This is slower than wordlist attacks but comprehensive for short passwords.

Hydra automatically saves progress and resumes interrupted sessions. When you restart the same command, Hydra detects the existing session file and continues from where it left off. Use -R to force resume of the last session, or -s PORT to specify a different port if the session was interrupted. Session files are stored in the current directory.

Yes, use the rdp module: hydra -l administrator -P wordlist.txt target rdp. RDP brute-forcing is slower than SSH due to the graphical protocol overhead, typically 5-20 attempts per second. Use -t 1 for single-threaded attacks to avoid locking accounts. Combine with enum4linux first to discover valid usernames.

Use the -C flag for combo files containing username:password pairs (one per line, separated by colon): hydra -C combo.txt target ssh. This is faster than separate -L and -P files when you have known credential pairs. For pipe input from other tools, use process substitution or temporary files.

The default is 16 threads. For SSH, 4-16 threads work well. For HTTP forms, use 1-4 threads to avoid overwhelming the server. For services with rate limiting or lockout policies, use 1-2 threads. Start low and increase gradually. Monitor for 'Too many connections' errors and reduce thread count if they appear.

Yes, use the sip module: hydra -l admin -P wordlist.txt target sip. SIP brute-forcing tests VoIP phone systems and PBX platforms for weak extensions and passwords. Common SIP targets include Asterisk, FreePBX, and Cisco Unified Communications. Slow threading (-t 1) is recommended to avoid disrupting voice services during testing.

Route Hydra through Tor using proxychains: install proxychains-ng, configure /etc/proxychains.conf with your Tor SOCKS5 proxy, then run proxychains hydra -l admin -P wordlist.txt target ssh. This anonymizes the source IP of brute-force attempts but adds significant latency. Tor is not recommended for high-volume attacks due to bandwidth limitations and connection instability.