timsonner Hydra
Purpose
Use this skill only for explicitly approved, low-rate credential validation against a narrow target and credential scope.
Phase Fit
- Primary: Validation and Controlled Impact Demonstration
- Secondary: Vulnerability Analysis, Retest and Closure
Use When
- Need to confirm whether a specific service accepts a narrowly bounded credential hypothesis.
- Need a repeatable retest for an approved authentication control issue.
- Need protocol-aware login validation with strong rate controls.
Avoid When
- Broad brute-force or spraying behavior is not explicitly approved.
- Lockout thresholds, alerting rules, or test accounts are unclear.
Inputs
- Approved protocol and target
- Explicitly allowed accounts or small credential set
- Lockout thresholds, timing, and stop conditions
Procedure
- Start with the smallest account and password set possible.
- Use the lowest concurrency that can answer the question.
- Stop as soon as the hypothesis is confirmed or disproved.
- Coordinate with defenders if alert validation is in scope.
- Preserve the exact account scope and rate settings for retest.
Command Syntax
Replace sample targets with approved in-scope assets and explicit test credentials.
# SSH single-credential check (low rate, high wait)
hydra -l auditor -p '<known-password>' ssh://10.10.10.100 -t 1 -W 5
# RDP credential validation
hydra -l auditor -p '<known-password>' rdp://10.10.10.100 -t 1 -W 5
# HTTP POST form login test
hydra -L users.txt -P passwords.txt 10.10.10.100 http-post-form "/login:username=^USER^&password=^PASS^:Invalid credentials" -t 4
# FTP credential check
hydra -l admin -P passwords.txt ftp://10.10.10.100
# SMB credential spray
hydra -L users.txt -p '<known-password>' smb://10.10.10.100
# Stop after first valid password per user
hydra -L users.txt -P passwords.txt ssh://10.10.10.100 -t 1 -f
Evidence to Capture
- Whether the tested service accepted the approved credential set
- Exact rate, account, and protocol context
- Lockout or alert behavior observed during the check
Safety Boundaries
- Do not use for broad credential attacks without explicit written approval.
- Stop immediately if lockouts, instability, or unexpected account effects occur.