Hydra

What is THC Hydra?

THC Hydra (usually just Hydra) is an online brute-force tool for authentication services, built by The Hacker's Choice. Unlike an offline cracker such as John the Ripper, Hydra attacks live services: it tries username and password combinations against a real login over the network. It supports a huge range of protocols: SSH, FTP, HTTP (forms and basic auth), SMB, RDP, MySQL, PostgreSQL, SMTP, VNC and dozens more.

Its great strength is parallelism: it fires multiple simultaneous attempts to speed things up. It is noisy by nature, so it is used in controlled, authorised environments to demonstrate the danger of weak credentials or missing lockout on failed attempts.

What Hydra is used for

• Auditing your own logins: checking whether your SSH, admin panel or FTP survive a dictionary attack.
• Authorised pentesting: validating password policies and the presence of anti-brute-force mechanisms (rate limiting, account lockout, captcha).
• CTF challenges and labs: many vulnerable machines require guessing a service's credentials.
• Defensive training: understanding what a credential attack looks like in the logs so you can detect it later.

Important: only use Hydra against services you own, lab machines, CTF challenges or systems with written authorisation. Attacking other people's logins is illegal and typically locks accounts and triggers alerts.

How to install Hydra

On Kali Linux and Parrot OS it comes preinstalled. On Debian/Ubuntu:

sudo apt update
sudo apt install hydra

On macOS with Homebrew:

brew install hydra

Check the install and see which protocols your version supports:

hydra -h

How to use Hydra: practical examples

The general syntax is: hydra [options] service://target. The key options are -l (one user), -L (user list), -p (one password) and -P (password list).

Brute-forcing SSH in your lab

hydra -l admin -P /usr/share/wordlists/rockyou.txt ssh://192.168.56.101

It tries every dictionary password for the admin user against the lab machine's SSH.

FTP with user and password lists

hydra -L users.txt -P passwords.txt ftp://192.168.56.101

HTTP login form (POST)

For a web form you use the http-post-form module with three colon-separated fields: the path, the parameters (with ^USER^ and ^PASS^ as placeholders) and a failure condition with F= (text that appears when the login is wrong):

hydra -l admin -P rockyou.txt 192.168.56.101 \
  http-post-form "/login:user=^USER^&pass=^PASS^:F=Invalid credentials"

If the server returns a specific string on success, you can use S= (success condition) instead of F=.

HTTP basic authentication

hydra -l admin -P rockyou.txt http-get://192.168.56.101/private-panel

Useful options

• -t 4: number of parallel tasks (lower it to 4 for SSH, which limits connections).
• -f: stop as soon as a valid pair is found.
• -s 2222: non-standard port.
• -V / -vV: verbose mode, shows each attempt.
• -o results.txt: save findings to a file.

hydra -l admin -P rockyou.txt -t 4 -f -V -o findings.txt ssh://192.168.56.101

Pro tips

• Lower the thread count for SSH. Many servers reject simultaneous connections; with -t 4 you get fewer errors and more reliable results.
• Capture a real request first. For web forms, intercept the login with Burp Suite to learn the exact path, parameter names and error message.
• Enumerate users first. A good list of real usernames multiplies your odds over generic lists.
• Online brute force is slow and loud. If you can obtain the hashes, cracking them offline with John or Hashcat is far more efficient.
• Beware account lockout. Too many attempts can lock out legitimate users; in an assessment, agree this with the client.

Pros and cons

Pros	Cons
Supports dozens of protocols	Very noisy: generates lots of logs and alerts
Fast thanks to parallelism	Slow against services with rate limiting
Free and preinstalled on Kali/Parrot	Web module syntax is fiddly at first

Hydra alternatives

• Medusa: similar philosophy, modular and fast, a good fallback when Hydra struggles with a service.
• Ncrack: from the Nmap team, aimed at large-scale network authentication auditing.
• Patator: very flexible and scriptable, ideal for bespoke cases.
• For offline hash attacks, John the Ripper and Hashcat.
• Practise on legal machines at TryHackMe or Hack The Box.

Frequently asked questions

Is Hydra legal?

The tool is legal. Using it against services without authorisation is not. Stick to your own systems, labs and CTF challenges.

What is the difference between Hydra and John the Ripper?

Hydra attacks live online services (trying logins over the network). John the Ripper cracks offline hashes you already hold. They are complementary.

Why does Hydra not work with my web form?

Almost always because of a poorly chosen F=/S= condition or wrong parameter names. Intercept a real request with Burp Suite and copy the path and fields exactly.

How many threads should I use?

It depends on the service. For SSH, use few (-t 4) to avoid rejections; for HTTP you can go higher, but watch the rate limiting and the target's stability.

If you want to practise authentication attacks legally and with guidance, you will find it at the Hackers en Acción Academy.