Hydra

Hydra (THC-Hydra, github.com/vanhauser-thc/thc-hydra¹) is a parallelized online login cracker — it brute-forces credentials against live network services rather than offline hash files. Maintained by van Hauser/THC with David Maciejak, it supports dozens of protocols (ssh, ftp, smb, rdp, vnc, http form logins, databases, …) and was one of the first tools to parallelize login attempts across protocols.

Hydra is the online counterpart to the offline crackers john-the-ripper and hashcat: where they attack captured hashes at GPU speed, Hydra attacks a running service — which means it is rate-limited by the target, generates authentication-failure noise, and risks account lockouts. In practice it is most useful against services with weak lockout policies or for password spraying (one password, many accounts — where it is quieter than pure brute force).

Basic usage

hydra -t 4 -l $USER_NAME -P $WORDLIST \
      -f $TARGET_IP_ADDRESS $SERVICE

$SERVICE is ssh, ftp, etc. — or the URL-style form service://server[:port]. Plain http is not used directly; instead use http-get-form / http-post-form for web logins.

Key flags:

• -l / -L FILE — single username / username list
• -p / -P FILE — single password / password list (-p with -L = password spraying)
• -C FILE — colon-separated login:pass pairs instead of -L/-P
• -f / -F — stop after the first successful match (per host / globally with -M)
• -t TASKS — parallel connections per target (default 16; many services choke on this — -t 4 is saner)
• -s PORT — non-default service port
• -e nsr — also try null password, login-as-password, reversed login
• -M FILE — list of multiple targets
• -o FILE / -b json — write found credentials to a file
• -V / -vV / -d — increasing verbosity; -U $SERVICE shows module-specific syntax

HTTP basic authentication

Before resorting to form modules, check whether the target is plain HTTP Basic Auth (Apache .htaccess/<Directory> protection, Tomcat manager, device admin panels — the response carries a WWW-Authenticate: Basic challenge and a 401). Hydra’s http-get / http-head / https-get modules attack these directly, taking a URL-style target with the protected path appended:

hydra -l $USER -P $WORDLIST -f -vV \
      http-get://$TARGET/protected/

No form template is needed — Hydra sends each guess as an Authorization: Basic header. Note the trailing path: for directory-protected areas the module needs the protected path (/protected/), not just the host. The -f flag stops at the first 200 response. The same pattern attacks the Tomcat manager app (/manager/html) whose WAR upload then yields RCE — see tomcat-manager-war-upload.

HTTP form logins

Web logins need extra syntax after http-get-form / http-post-form; look up the per-module template with hydra $SERVICE -U. The placeholders ^USER^ and ^PASS^ mark where guesses are substituted, and the condition strings S= (success) / F= (failure) are substring matches on the response:

hydra -vV -f -l $USERNAME -P $PASSWORDLIST \
      $HOST http-post-form \
      "$ENDPOINT:$TEMPLATE:F=$INVALID:H=Content-Type\: application/json"

$TEMPLATE is the request body with ^USER^/^PASS^ placeholders (colons escaped); $INVALID is a substring that appears on failed logins (it cannot contain a colon); the trailing H= overrides headers — required for JSON APIs, since Hydra otherwise sends Content-Type: application/x-www-form-urlencoded. This same technique attacks JSON API login endpoints.

For high-rate fuzzing of web parameters and paths, ffuf, wfuzz, and gobuster are generally better suited; Hydra’s niche is credential guessing against authenticated services.

Sources

• vanhauser-thc/thc-hydra on GitHub
• Kali Linux Tools: hydra

Related: john-the-ripper, hashcat, kerbrute, cupp-common-user-passwords-profiler, cewl-custom-wordlist-generator, ffuf, h8mail

Footnotes

1. vanhauser-thc/thc-hydra — GitHub Repository ↩