X-HYD
hydra
Parallelized network login cracker that tests credentials against dozens of protocols, from SSH and RDP to web forms.
OVERVIEW
Hydra (THC-Hydra, github.com/vanhauser-thc/thc-hydra) is a parallelized login cracker that automates trying many username/password combinations against a network service, supporting well over 50 protocols out of the box — SSH, RDP, FTP, SMB, VNC, HTTP/HTTPS forms, databases, and more — through a common command syntax with per-protocol modules.
It's used for two distinct purposes that both belong in a pentest report: classic brute-forcing (many passwords against one account) to test password-policy strength, and password spraying (one or a few common passwords against many accounts) to find accounts using default or trivially guessable credentials without tripping a per-account lockout threshold.
USE CASES
Practical use cases
- 01
Brute-forcing a single account's password against SSH, RDP, or another exposed login service to test policy strength.
- 02
Password-spraying a small set of common or seasonal passwords across many usernames to avoid per-account lockout.
- 03
Testing whether a web login form accepts credentials from a client-approved candidate list.
- 04
Validating that account lockout and rate-limiting controls actually trigger under a sustained login-attempt burst.
QUICK START
Once a login prompt is in scope, to test whether it accepts weak, default, or previously breached credentials across a protocol Hydra supports.
- Get explicit written scope for this specific service, including whether brute-force (many passwords/one account) or spraying (few passwords/many accounts) is authorized, given the account-lockout risk.
- Install Hydra (thc-hydra) and identify the correct module for the target protocol (ssh, rdp, http-post-form, etc.).
- Prepare a scoped username and password list — never a full default wordlist against production accounts without agreement.
- Run Hydra with a conservative thread count (-t) against the target, watching for lockouts or service instability.
- Record every account tested and any successful hit, then stop rather than continuing to brute-force past the agreed limit.
hydra -L users.txt -P passwords.txt ssh://10.10.10.10BEFORE YOU RUN IT
What to check before running it
Brute-forcing or spraying without explicit written scope covering this exact service and account-lockout tolerance risks locking out real users or even triggering a client's incident response — get sign-off before running it, not after.
Account lockout policies mean brute-force (many passwords, one account) and spraying (few passwords, many accounts) carry very different risk profiles; agree with the client which mode, thread count, and password list size are acceptable.
Failed login floods are a well-monitored SIEM/EDR signal — coordinate timing with the client if detection response is part of what's being tested.