Mastering Hydra: 20 Essential Commands for Password Auditing
Hydra is a fast, parallelized login cracker that supports numerous protocols including SSH, FTP, HTTP, SMB, MySQL, and more. It is one of the most widely used tools for credential auditing and password strength testing during authorized penetration tests. This guide walks through twenty practical Hydra commands, explaining what each does and when to reach for it during a security assessment.
1. Basic SSH Brute Force
hydra -l admin -P /usr/share/wordlists/rockyou.txt ssh://192.168.1.1
The -l flag specifies a single username, while -P points to a password wordlist. This command attempts to authenticate to SSH using the username "admin" against every password in the rockyou list. It is the most fundamental Hydra invocation for testing SSH credential strength.
2. Brute Force with Username List
hydra -L users.txt -P passwords.txt ssh://192.168.1.1
The uppercase -L flag supplies a file containing multiple usernames. Hydra will attempt every combination of username and password. This is useful when you have enumerated valid usernames but do not know their passwords.
3. FTP Authentication Testing
hydra -l ftpuser -P passwords.txt ftp://192.168.1.1
Hydra supports FTP natively. This command tests a single FTP username against a password list. FTP remains common on internal networks and often uses weak or default credentials.
4. HTTP POST Form Attack
hydra -l admin -P passwords.txt 192.168.1.1 http-post-form "/login.php:user=^USER^&pass=^PASS^:Invalid credentials"
The http-post-form module targets web login forms. The format is path:parameters:failure_string. Hydra replaces ^USER^ and ^PASS^ with credentials and detects failure by the string "Invalid credentials" appearing in the response.
5. HTTP GET Form Attack
hydra -l admin -P passwords.txt 192.168.1.1 http-get-form "/login.php:user=^USER^&pass=^PASS^:F=Login failed"
The http-get-form module works similarly but sends credentials via URL parameters. The F= prefix explicitly marks the failure condition string. Use this when the application authenticates through GET requests.
6. Basic HTTP Authentication
hydra -l admin -P passwords.txt 192.168.1.1 http-get /
This tests HTTP Basic authentication prompts. When a server returns a 401 status and prompts for credentials, this command cycles through the password list attempting to gain access.
7. SMB Authentication Testing
hydra -l administrator -P passwords.txt smb://192.168.1.1
The SMB module tests Windows file sharing credentials. This is valuable during internal assessments where SMB is often exposed and weak local administrator passwords can lead to lateral movement.
8. MySQL Database Attack
hydra -l root -P passwords.txt mysql://192.168.1.1
This targets MySQL database authentication. Databases are frequently misconfigured with weak root passwords or exposed to internal networks without proper access controls.
9. RDP Authentication Testing
hydra -l administrator -P passwords.txt rdp://192.168.1.1
The RDP module tests Remote Desktop Protocol credentials. RDP exposure is a common finding in internal networks and a frequent entry point for ransomware operators.
10. Specify a Non-Default Port
hydra -l admin -P passwords.txt -s 2222 ssh://192.168.1.1
The -s flag specifies a custom port. Services frequently run on non-standard ports to avoid automated scanning. Always verify the actual port before assuming defaults.
11. Limit Parallel Tasks
hydra -l admin -P passwords.txt -t 4 ssh://192.168.1.1
The -t flag controls the number of parallel connections per target. The default is 16, which can overwhelm fragile services or trigger account lockouts. Reducing to 4 or fewer is safer for production systems.
12. Add a Delay Between Attempts
hydra -l admin -P passwords.txt -t 2 -W 3 ssh://192.168.1.1
The -W flag sets the wait time in seconds between connection attempts. Combined with reduced task count, this helps avoid detection by rate-limiting systems and account lockout policies.
13. Continue After Finding Credentials
hydra -l admin -P passwords.txt -f ssh://192.168.1.1
The -f flag stops the attack as soon as a valid password is found. Without it, Hydra continues testing the remaining passwords even after success. Always use -f unless you specifically need to discover all valid credentials.
14. Verbose Output
hydra -l admin -P passwords.txt -V ssh://192.168.1.1
The -V flag displays every username and password combination being attempted. This is useful for debugging failed attacks, confirming that Hydra is reaching the service, and understanding timing behavior.
15. Save Output to a File
hydra -l admin -P passwords.txt -o results.txt ssh://192.168.1.1
The -o flag writes successful credentials to a file. Always save results during assessments to maintain an audit trail and avoid repeating work.
16. Resume an Interrupted Attack
hydra -l admin -P passwords.txt -R ssh://192.168.1.1
The -R flag restores a previously interrupted session. Hydra saves progress to a restore file automatically. This is essential for long-running attacks that may be interrupted by network issues.
17. Attack Multiple Targets
hydra -l admin -P passwords.txt -M targets.txt ssh
The -M flag reads a list of targets from a file. The protocol is specified separately at the end. This scales the attack across an entire subnet or inventory of hosts.
18. Combine Username and Password Lists with Colon
hydra -C credentials.txt ssh://192.168.1.1
The -C flag uses a colon-separated file where each line contains username:password. This tests specific credential pairs rather than generating the full Cartesian product, which is faster when you have known combinations to verify.
19. Test Empty Passwords
hydra -l admin -p "" ssh://192.168.1.1
The lowercase -p flag specifies a single password. Using an empty string tests whether accounts permit blank passwords. This is a quick check that occasionally yields surprising results on misconfigured systems.
20. Generate a Report in JSON Format
hydra -l admin -P passwords.txt -o results.json -b json ssh://192.168.1.1
The -b flag sets the output format for the results file. JSON output integrates cleanly with reporting tools, dashboards, and automated pipelines. This is preferred when Hydra results feed into a larger assessment workflow.
Explore More Tools
For a comprehensive collection of hacking tools, cheat sheets, and resources, visit my GitHub repository:
https://github.com/yogsec/Hacking-Tools/
Stay connected for more security content and updates:
Top comments (0)