# Hydra

> Auth/lab ref: Online brute-force and password spraying tool supporting 50+ protocols (SSH, HTTP, FTP, SMB, RDP, WinRM, and more).

- Skill: `aeondave/hydra` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add aeondave/hydra`
- Raw SKILL.md: https://api.skillmd.com/api/skills/aeondave/hydra/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- License: AGPL-3.0
- Author: AeonDave (https://skillmd.com/u/aeondave)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/aeondave/hydra

---


# Hydra

Fast, parallelized online password cracker for 50+ protocols.

## Quick Start

```bash
# SSH brute-force
hydra -l admin -P passwords.txt ssh://192.168.1.10

# HTTP POST form
hydra -l admin -P passwords.txt 192.168.1.10 http-post-form "/login:user=^USER^&pass=^PASS^:Invalid"

# Multiple users + passwords
hydra -L users.txt -P passwords.txt ssh://192.168.1.10
```

## Core Flags

| Flag | Description |
|------|-------------|
| `-l <user>` | Single username |
| `-L <file>` | Username list |
| `-p <pass>` | Single password |
| `-P <file>` | Password list |
| `-u` | Loop users before passwords (default: passwords first) |
| `-C <file>` | Colon-delimited user:pass list |
| `-t <n>` | Threads per host (default 16) |
| `-T <n>` | Total parallel targets |
| `-s <port>` | Custom port |
| `-S` | Use SSL/TLS |
| `-o <file>` | Output found credentials |
| `-f` | Stop after first valid pair (per host) |
| `-F` | Stop after first valid pair (all hosts) |
| `-v` | Verbose |
| `-V` | Very verbose (show each attempt) |
| `-d` | Debug |
| `-R` | Restore previous session |
| `-I` | Ignore existing restore file (start fresh) |
| `-e nsr` | Try: n=empty pass, s=user as pass, r=reversed user |
| `-w <sec>` | Wait time for server response (default 32s) |
| `-W <sec>` | Wait between connect attempts per thread (rate throttle) |
| `-x proto` | SOCKS5/HTTP proxy: `-x socks5://127.0.0.1:1080` |

## Supported Modules (Common)

`ssh`, `ftp`, `http-get`, `http-post-form`, `https-post-form`, `smb`, `rdp`, `winrm`, `imap`, `pop3`, `smtp`, `mysql`, `postgres`, `mssql`, `telnet`, `vnc`, `ldap2`, `redis`

## Common Workflows

```bash
# SSH with user list
hydra -L users.txt -P rockyou.txt ssh://10.10.10.10 -t 4

# HTTP form login
hydra -l admin -P passwords.txt 10.10.10.10 http-post-form \
  "/admin/login.php:username=^USER^&password=^PASS^:Wrong password"

# RDP brute-force
hydra -l administrator -P passwords.txt rdp://10.10.10.10

# FTP
hydra -l ftp -P passwords.txt ftp://10.10.10.10

# SMB password spray (single password, many users)
hydra -L users.txt -p "Summer2024!" smb://10.10.10.10

# WinRM
hydra -l administrator -P passwords.txt winrm://10.10.10.10

# Rate-limited (avoid lockouts)
hydra -l admin -P passwords.txt ssh://10.10.10.10 -t 1 -W 3
```

## Proxy / Evasion

```bash
# Route through SOCKS5 (Tor or pivoting)
hydra -l admin -P passwords.txt -x socks5://127.0.0.1:1080 ssh://10.10.10.10

# HTTP proxy
hydra -l admin -P passwords.txt -x http://127.0.0.1:8080 http-post-form \
  "/login:user=^USER^&pass=^PASS^:Invalid"
```

## Tips

- Use `-e nsr` for quick wins (null, same as user, reversed)
- Set `-t 1-4` for protocols with lockout policies (RDP, SMB, WinRM)
- `-W 3` adds 3s between connect attempts per thread — avoids fail2ban bans
- `-w` controls response timeout; increase for slow targets (e.g., `-w 10`)
- For HTTP forms: identify `failure_message` from the response body
- Use `-I` to ignore leftover restore files from previous interrupted runs

## Resources

| File | When to load |
|------|--------------|
| `references/protocols.md` | Module syntax for each protocol, POST form detection, HTTPS handling |