Pentest Tools


Hydra Cheatsheet

How to Install Hydra

Hydra installation:

Installation
username@machine_name:~$ sudo apt install hydra

Useful Commands for Hydra


-l [login]: Specify a single username
-L [file]: Specify a file containing usernames
-p [password]: Specify a single password
-P [file]: Specify a file containing passwords
-s [port]: Specify the port to use
-t [tasks]: Specify the number of parallel tasks
-v / -V: Verbose mode / Very verbose mode
-e [nsr]: Try null password / try the login as the password / try a reverse login
-o [file]: Write found login/password pairs to file
-f: Exit after the first found login/password pair

Examples of Hydra Commands

Brute force SSH with a single username and a password list:

SSH Brute-force
username@machine_name:~$ hydra -l admin -P /path/to/password_list.txt ssh://target_ip

Brute force FTP with a username list and a password list:

FTP Brute-force
username@machine_name:~$ hydra -L /path/to/user_list.txt -P /path/to/password_list.txt ftp://target_ip

Brute force a web form using POST requests:

Web Form Brute-force
username@machine_name:~$ hydra -l admin -P /path/to/password_list.txt target_ip http-post-form "/login.php:username=^USER^&password=^PASS^:F=incorrect"

Brute force with specified port and number of parallel tasks:

Specified Port and Tasks
username@machine_name:~$ hydra -l admin -P /path/to/password_list.txt -s 2222 -t 4 ssh://target_ip

Brute force RDP with exit after first found pair:

RDP Brute-force
username@machine_name:~$ hydra -l admin -P /path/to/password_list.txt -f rdp://target_ip

Write found login/password pairs to a file:

Output to File
username@machine_name:~$ hydra -l admin -P /path/to/password_list.txt -o found_credentials.txt ssh://target_ip