Hydra — Login Brute-Forcer GuideStep-by-step Hydra reference: brute-force SSH, FTP and web logins on your own lab VMs with wordlists. Educational use only.FAQ

What is Hydra?

Hydra (THC-Hydra) is the classic online password guesser: it tries username/password pairs against live login services — SSH, FTP, HTTP forms, RDP and dozens more. You give it a target, a user list and a password list; it reports what worked.

Is Hydra illegal?

The tool is legal for audits. Using it against logins you do not own or lack permission to test is illegal — even one guess at someone else's account counts. Practice on Metasploitable or your own VMs.

What do -l, -L, -p, -P mean?

-l is one fixed username, -L is a file of usernames. -p is one fixed password, -P is a file of passwords (like rockyou.txt). So -l admin -P rockyou.txt tries admin against every line of the list.

What does -t do?

-t sets parallel tasks (default 16). More tasks = faster but noisier and more likely to lock accounts or get blocked. In labs 4-16 is typical; against anything shared keep it low.

How do I attack a web login form?

Use the http-post-form module with the path, the POST body using ^USER^ and ^PASS^ placeholders, and the failure string: hydra -l admin -P rockyou.txt target http-post-form "/login:user=^USER^&pass=^PASS^:Login failed".

Why did Hydra find nothing?

Either the credentials are not in your lists, the failure string is wrong (for web forms), or the service rate-limits/blocks you. Verify the login manually first, then check -V verbose output.

What is the difference between Hydra and Hashcat?

Hydra guesses against a LIVE service over the network (online, slow, lockout risk). Hashcat cracks stolen hash files offline on GPU (fast, no lockouts). Different phases, often used together.

How do I protect my logins from Hydra?

Long unique passwords from a manager, 2FA on everything, fail2ban or rate-limiting after a few failures, and key-only SSH with PasswordAuthentication off. Any one of these breaks naive brute force.

All tools · Sitemap · Games