System Hacking · Module 06
Hydra
Fast online password-strength testing tool supporting many protocols.
Authorized use only. This tool can disrupt systems or intercept other people’s traffic. Use it strictly on an isolated lab you own (e.g. your Kali VM) or where you have explicit written permission.
Definition
Hydra is a parallelized network login (credential) testing tool that supports many protocols.
Test the strength of authentication by attempting login combinations against network services.
Authorized password-strength and authentication-resilience testing during penetration tests and audits — never against systems without explicit permission.
Key features
Supports SSH, FTP, Telnet, HTTP(S) forms, SMB, RDP, databases and more.
Runs multiple login attempts concurrently to speed up testing.
Accepts single users/passwords, wordlists, or combined user:pass lists.
Can resume an interrupted session.
Detailed output for troubleshooting during a test.
Important commands
hydra -l <user> -P <wordlist> <target> <service>Test one username against a password list.
hydra -L <userlist> -P <wordlist> <target> <service>Test a list of usernames against a password list.
hydra -C <combo.txt> <target> <service>Use a combined user:pass list.
hydra -s <port> ...Specify a non-default port.
hydra -t <n> ...Set the number of parallel threads.
hydra -V ...Verbose output showing each attempt.
Practical examples
hydra -l admin -P rockyou.txt ssh://192.168.1.10
Purpose Tests a known username against a password list over SSH, in an authorized lab.
hydra -L users.txt -P passwords.txt ftp://192.168.1.10
Purpose Tests combinations of usernames and passwords against FTP.
hydra -l admin -P passwords.txt 192.168.1.10 http-post-form "/login:user=^USER^&pass=^PASS^:Invalid login"
Purpose Tests a login form by submitting POST requests and matching a failure string.
Important points
- Strict authorization required: Running Hydra without documented permission is illegal in most places and can disrupt services.
- Account lockouts: Aggressive testing can lock out real accounts or trigger alerts — coordinate scope and timing.
- Rate limiting: Many services throttle failed logins, affecting speed and results.
- Not a silent tool: Attempts are logged; detection is expected and is often part of what a test evaluates.
Common use cases
Verify accounts are not using weak or default credentials.
Assess whether lockout and rate-limiting controls work.
Support the credential-testing phase of a scoped engagement.
Blue teams confirm monitoring catches brute-force attempts.
This tool is taught in Module 06
Read the full written notes, with diagrams, defense and detection.