# Hydra

> Use for tightly scoped credential validation during authorized pentests. Trigger on approved login checks, low-rate credential hypothesis testing, and confirming whether a specific service accepts a known or narrowly bounded credential set.

- Skill: `timsonner/hydra` (Agent Skill)
- Install (CLI): `npx skillmds@latest add timsonner/hydra`
- Raw SKILL.md: https://api.skillmd.com/api/skills/timsonner/hydra/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- License: MIT
- Author: timsonner (https://skillmd.com/u/timsonner)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/timsonner/hydra

---


# Hydra

## Purpose

Use this skill only for explicitly approved, low-rate credential validation against a narrow target and credential scope.

## Phase Fit

- Primary: Validation and Controlled Impact Demonstration
- Secondary: Vulnerability Analysis, Retest and Closure

## Use When

- Need to confirm whether a specific service accepts a narrowly bounded credential hypothesis.
- Need a repeatable retest for an approved authentication control issue.
- Need protocol-aware login validation with strong rate controls.

## Avoid When

- Broad brute-force or spraying behavior is not explicitly approved.
- Lockout thresholds, alerting rules, or test accounts are unclear.

## Inputs

- Approved protocol and target
- Explicitly allowed accounts or small credential set
- Lockout thresholds, timing, and stop conditions

## Procedure

1. Start with the smallest account and password set possible.
2. Use the lowest concurrency that can answer the question.
3. Stop as soon as the hypothesis is confirmed or disproved.
4. Coordinate with defenders if alert validation is in scope.
5. Preserve the exact account scope and rate settings for retest.

## Command Syntax

Replace sample targets with approved in-scope assets and explicit test credentials.

```bash
# SSH single-credential check (low rate, high wait)
hydra -l auditor -p '<known-password>' ssh://10.10.10.100 -t 1 -W 5

# RDP credential validation
hydra -l auditor -p '<known-password>' rdp://10.10.10.100 -t 1 -W 5

# HTTP POST form login test
hydra -L users.txt -P passwords.txt 10.10.10.100 http-post-form "/login:username=^USER^&password=^PASS^:Invalid credentials" -t 4

# FTP credential check
hydra -l admin -P passwords.txt ftp://10.10.10.100

# SMB credential spray
hydra -L users.txt -p '<known-password>' smb://10.10.10.100

# Stop after first valid password per user
hydra -L users.txt -P passwords.txt ssh://10.10.10.100 -t 1 -f
```

## Evidence to Capture

- Whether the tested service accepted the approved credential set
- Exact rate, account, and protocol context
- Lockout or alert behavior observed during the check

## Safety Boundaries

- Do not use for broad credential attacks without explicit written approval.
- Stop immediately if lockouts, instability, or unexpected account effects occur.