Mastering Hydra for Password Cracking (with examples)

Hydra is a versatile online password-guessing tool widely used for penetration testing and ethical hacking. Its strength lies in its ability to support multiple protocols such as FTP, HTTP(S), SMTP, SNMP, XMPP, SSH, and many more. The tool aids security professionals in identifying weak passwords across different network services, helping to enhance cybersecurity measures. Hydra’s capability to automate password brute-forcing makes it a valuable asset in the cybersecurity toolkit.

Start Hydra’s wizard

Code:

hydra-wizard

Motivation:

The Hydra wizard offers an interactive setup process, simplifying the task for beginners or professionals unfamiliar with the tool’s command-line options. By guiding users through step-by-step configuration, it ensures that complex options are appropriately set for desired operations.

Explanation:

• hydra-wizard: This command initiates Hydra’s interactive wizard interface. Unlike standard command-line execution, this tool aids users through a simplified method of establishing necessary parameters for an effective brute-force attack.

Example output:

Welcome to Hydra Wizard
Choose the protocol from the following list: FTP, HTTP, SSH, etc.
Enter the target host IP address: _
Enter the username wordlist path: _
Enter the password wordlist path: _
...

Use case 1: Guess SSH credentials using a given username and a list of passwords

Code:

hydra -l username -P path/to/wordlist.txt host_ip ssh

Motivation:

SSH (Secure Shell) is a widely adopted protocol used for secure remote management and file transfers. By testing SSH credentials, cybersecurity experts can pinpoint weak passwords and strengthen access controls. This use case is crucial to ensure that SSH access points are fortified against unauthorized access.

Explanation:

• -l username: Specifies the username for which the password guessing will be attempted. This is necessary when the username is known or suspected.
• -P path/to/wordlist.txt: Defines the path to the text file containing a list of potential passwords. This file serves as the source for the brute-force attack.
• host_ip: The IP address or hostname of the target machine running the SSH service.
• ssh: Indicates that the SSH protocol will be used for the password guessing process.

Example output:

Hydra v9.1 (c) 2020 by van Hauser/THC & David Maciejak
Attempting to login...
[22][ssh] host: 192.168.1.1   login: username   password: password123
[22][ssh] host: 192.168.1.1   login: username   password: testpass
[22][ssh] host: 192.168.1.1   login: username   password: securepassword

Use case 2: Guess HTTPS webform credentials using two specific lists of usernames and passwords

Code:

hydra -L path/to/usernames.txt -P path/to/wordlist.txt host_ip https-post-form "url_without_host:https_post_request:login_failed_string"

Motivation:

Web applications often use HTTPS webforms for user authentication. Targeting these forms allows testers to discover vulnerabilities in web interfaces. Using lists of usernames and passwords to test login forms can highlight weaknesses in password policies and overall web security.

Explanation:

• -L path/to/usernames.txt: Specifies the file containing multiple usernames for which the password guessing will be performed.
• -P path/to/wordlist.txt: Defines the wordlist file path for potential passwords.
• host_ip: The host’s IP where the webform is located.
• https-post-form "url_without_host:https_post_request:login_failed_string": Specifies the endpoint and form data that should be used to attempt logging in, where url_without_host is the path to the form, https_post_request represents the form data structure with placeholders for username and password, and login_failed_string is the string found in the response indicating a failed login attempt.

Example output:

Hydra v9.1 (c) 2020 by van Hauser/THC & David Maciejak
Attempting to login...
[443][https-post-form] host: 192.168.1.1   login: admin   password: admin123
[443][https-post-form] host: 192.168.1.1   login: admin   password: letmein

Use case 3: Guess FTP credentials using usernames and passwords lists, specifying the number of threads

Code:

hydra -L path/to/usernames.txt -P path/to/wordlist.txt -t n_tasks host_ip ftp

Motivation:

FTP servers often hold sensitive or critical files and data. Security experts need to locate weak points in FTP authentication to ensure the channel’s integrity. By optimizing the number of threads, users can control the speed and load of the brute-force process.

Explanation:

• -L path/to/usernames.txt: The text file containing a list of potential usernames.
• -P path/to/wordlist.txt: The wordlist containing possible passwords.
• -t n_tasks: Indicates the number of parallel tasks or threads to utilize during the operation. More threads can lead to faster password checking but may increase server load.
• host_ip: The targeted host running the FTP service.
• ftp: Denotes the use of the FTP protocol for credential guessing.

Example output:

Hydra v9.1 (c) 2020 by van Hauser/THC & David Maciejak
Running with 4 threads...
[21][ftp] host: 192.168.1.50   login: user1   password: pass123
[21][ftp] host: 192.168.1.50   login: admin   password: welcome

Use case 4: Guess MySQL credentials using a username and a passwords list, exiting when a username/password pair is found

Code:

hydra -l username -P path/to/wordlist.txt -f host_ip mysql

Motivation:

MySQL databases are crucial repositories of data, and securing access to them is a priority. Testing for weak credentials in MySQL can provide insights into potential vulnerabilities that need to be addressed. This use case showcases the importance of database security verification in a network.

Explanation:

• -l username: Provides the username for which passwords are being tested.
• -P path/to/wordlist.txt: Describes the wordlist file with possible password combinations.
• -f: Tells Hydra to stop the operation once a successful username/password pair has been found, saving time and processing power.
• host_ip: The server’s IP address hosting the MySQL service.
• mysql: Specifies the use of the MySQL protocol for this operation.

Example output:

Hydra v9.1 (c) 2020 by van Hauser/THC & David Maciejak
Trying login with known username...
[3306][mysql] host: 192.168.1.100  login: dba   password: secret123
Login successful, terminating.

Use case 5: Guess RDP credentials using a username and a passwords list, showing each attempt

Code:

hydra -l username -P path/to/wordlist.txt -V rdp://host_ip

Motivation:

RDP (Remote Desktop Protocol) services are often exploited due to weak credentials. Ensuring that robust authentication measures are in place involves testing known usernames against password lists. Displaying each attempt is particularly useful during a thorough diagnostic or when sharing live progress with a team.

Explanation:

• -l username: Username being tested against the password list.
• -P path/to/wordlist.txt: Path to the file with possible passwords.
• -V: Verbose mode. Outputs each password attempt to the console—useful for detailed monitoring or logging.
• rdp://host_ip: Specifies using the RDP protocol and provides the target host’s IP.

Example output:

Hydra v9.1 (c) 2020 by van Hauser/THC & David Maciejak
Starting attempt with verbose output...
[3389][rdp] host: 192.168.1.15   login: admin   password: 123456
[3389][rdp] host: 192.168.1.15   login: admin   password: pass123

Use case 6: Guess IMAP credentials on a range of hosts using a list of colon-separated username/password pairs

Code:

hydra -C path/to/username_password_pairs.txt imap://[host_range_cidr]

Motivation:

IMAP protocols are typically used for email services, a high-value target for attackers seeking sensitive data or foothold in networks. Testing them in bulk across a range of hosts allows penetration testers to verify security measures on multiple targets efficiently.

Explanation:

• -C path/to/username_password_pairs.txt: Specifies the file containing username and password pairs, formatted with a colon between them.
• imap://[host_range_cidr]: Indicates the protocol and the range of hosts to test, expressed in CIDR notation for scalability.

Example output:

Hydra v9.1 (c) 2020 by van Hauser/THC & David Maciejak
Testing range of hosts...
Host: 192.168.2.1  IMAP [OK]
Host: 192.168.2.2  IMAP [FAILED] login: user@example.com

Use case 7: Guess POP3 credentials on a list of hosts using usernames and passwords lists, exiting when a username/password pair is found

Code:

hydra -L path/to/usernames.txt -P path/to/wordlist.txt -M path/to/hosts.txt -F pop3

Motivation:

Protecting email servers that use the POP3 protocol is crucial for preventing unauthorized data access. This use involves verifying credentials across multiple email servers, with immediate termination upon finding valid credentials to reduce unnecessary load during the operation.

Explanation:

• -L path/to/usernames.txt: List of potential usernames.
• -P path/to/wordlist.txt: File containing possible passwords.
• -M path/to/hosts.txt: Specifies the file with a list of hosts to target.
• -F: Adds the functionality to terminate on successful login credentials, conserving resources.
• pop3: Instructs Hydra to test the POP3 protocol.

Example output:

Hydra v9.1 (c) 2020 by van Hauser/THC & David Maciejak
Attempting to login to email servers...
Host: mail1.example.com  [SUCCESS] login: admin  password: emailpass123
Found valid credentials, stopping.

Conclusion:

Hydra is an indispensable tool for cybersecurity practitioners, providing comprehensive and customizable options for testing various types of network authentication mechanisms. By leveraging its capabilities, organizations and testers can ensure that their security measures are robust against unauthorized access attempts. These use cases exemplify its functionality across distinct protocols and target scenarios, affirming its value in the cybersecurity domain. Always use Hydra ethically, with proper authorization, and in line with legal regulations.