security enabled verified medium v1.0.0

hydra

Very fast parallel network logon cracker supporting numerous protocols for brute-force authentication testing.

📋 Live Preview

hydra -l {username} -P {password-list} {target} {service}

🌍 username → admin 🌍 password-list → 🌍 target → 🌍 service → ssh

hydra -l {username} -P {password-list} {target} {service}

Sandbox: execFile · Timeout: 3600s

Capabilities

security.crack.password

security.auth.bruteforce

security.audit.credential

network.auth.test

Parameters

Name	Type	Required	Default	Description	Aliases
`flag-l`	string	No	-	Single username to try	`-l`, `--login`
`flag-L`	string	No	-	File with list of usernames	`-L`, `--login-list`
`flag-p`	string	No	-	Single password to try	`-p`, `--password`
`flag-P`	string	No	-	File with list of passwords	`-P`, `--password-list`
`flag-s`	integer	No	-	Target port number	`-s`, `--port`
`flag-t`	integer	No	-	Number of parallel tasks (default 16)	`-t`, `--tasks`
`flag-v`	boolean	No	-	Verbose output	`-v`, `--verbose`
`flag-V`	boolean	No	-	Show each login attempt	`-V`, `--verbose-login`
`flag-o`	string	No	-	Output file for results	`-o`, `--output`
`flag-f`	boolean	No	-	Exit after first found login/password pair	`-f`, `--found`
`flag-F`	boolean	No	-	Exit per service after first found pair	`-F`, `--quit-per-service`
`flag-M`	string	No	-	File with list of target servers	`-M`, `--server-list`
`flag-w`	integer	No	-	Wait time in seconds between attempts	`-w`, `--wait`
`flag-e`	string	No	-	Extra checks (n=null, s=same-as-login, r=reverse-login)	`-e`, `--extra`
`flag-x`	string	No	-	Password generation pattern (e.g. -x 6:8:a1)	`-x`, `--password-generation`
`flag-S`	boolean	No	-	Connect via SSL	`-S`, `--ssl`
`flag-u`	boolean	No	-	Loop around users (not passwords) on each attempt	`-u`, `--loop-round-users`
`flag-I`	boolean	No	-	Ignore restore file (do not resume)	`-I`, `--ignore-restore`
`flag-R`	boolean	No	-	Restore previous aborted session	`-R`, `--restore`
`flag-q`	boolean	No	-	Quiet mode (no banner)	`-q`, `--quiet`
`4`	boolean	No	-	prefer IPv4 or IPv6 (default: auto)	`-4`, `-6`
`C`	boolean	No	-	FILE colon separated "login:pass" format file	`-C`
`H`	boolean	No	-	print extended help screen	`-H`
`I`	boolean	No	-	ignore restore file (don't wait 3s)	`-I`
`R`	boolean	No	-	restore a previous aborted session	`-R`
`U`	boolean	No	-	TASKS run TASKS login attempts in parallel (per module)	`-U`
`b`	boolean	No	-	TEXT\|JSON\|CSV output format (default: text)	`-b`
`d`	boolean	No	-	debug mode	`-d`
`h`	boolean	No	-	print help screen	`-h`
`q`	boolean	No	-	do not print connection messages	`-q`
`r`	boolean	No	-	no reset of connection after each attempt	`-r`
`u`	boolean	No	-	loop around users, not passwords	`-u`
`y`	boolean	No	-	generation	`-y`, `-x`
`z`	boolean	No	-	display comprehensive module information	`-z`

Artifacts

Type	Description	MIME	Schema	Trust
`security.crack.results`	Brute-force results log	text/plain	-	verified

Contract

Inputs

network.target.ip

Target IP address or hostname

network.target.port

Target port (optional, auto-detected for most services)

security.username.list

File containing usernames

security.password.list

File containing passwords

Outputs

security.valid.credentials

Successfully discovered credentials

security.auth.results

Authentication attempt results

Side effects: network_trafficfilesystem_write

Workflow Edges

Produces

security.valid.credentialssecurity.auth.results

Consumes

network.target.ipnetwork.target.portsecurity.username.listsecurity.password.list

Resource Profile

Resource	Value
CPU	medium
Memory	128 MB
Network	high
Disk I/O	low

Examples

Brute-force SSH with username and password list

hydra -l admin -P passwords.txt 192.168.1.100 ssh

Brute-force HTTP form with user list

hydra -L users.txt -P passwords.txt 192.168.1.100 http-post-form "/login:user=^USER^&pass=^PASS^:F=invalid"

Brute-force FTP with verbose output

hydra -l root -P passwords.txt -v 192.168.1.100 ftp

Multiple targets from file

hydra -l admin -P passwords.txt -M targets.txt ssh

Null and same-as-login checks

hydra -l admin -P passwords.txt -e ns 192.168.1.100 rdp

SSL-enabled service on custom port

hydra -l admin -P passwords.txt -s 2222 -S 192.168.1.100 ssh

Restore aborted session

hydra -R

Password generation mode

hydra -l admin -x 6:8:a1 192.168.1.100 ftp

Documentation

THC-Hydra — Network Logon Cracker

Hydra is a highly parallel network authentication cracking tool that supports over 50 protocols including SSH, FTP, HTTP(S), RDP, SMB, MySQL, PostgreSQL, SMTP, and many more. It is designed to quickly test credential strength across network services.

Supported Protocols

Protocol	Service Argument	Default Port
SSH	`ssh`	22
FTP	`ftp`	21
HTTP(S)	`http-get` / `http-post-form`	80/443
RDP	`rdp`	3389
SMB	`smb`	445
MySQL	`mysql`	3306
PostgreSQL	`postgres`	5432

Performance Tuning

-t 64 — increase parallel tasks (default 16)
-w 1 — add wait time between attempts
-f — stop after first valid credential found
-F — stop per service after first credential

Smart Checks

-e n — try null password
-e s — try password same as login
-e r — try reverse login as password
Combine as -e nsr for all extra checks

Related Tools

medusancrackpatator