Ravindra BagaleCourses & study guides

22. Password Attacks

22.5 Hydra: Online Login Testing

By Last updated:

Hydra tries username/password combinations against a live service – SSH, FTP, HTTP forms, and more. This is an online attack, so it is slow and noisy. Lab only.

# SSH
hydra -l msfadmin -P /usr/share/wordlists/rockyou.txt ssh://192.168.56.20
# FTP with a user list
hydra -L users.txt -P rockyou.txt ftp://192.168.56.20
# a web login form (path:params:failure-string)
hydra -l admin -P rockyou.txt 192.168.56.20 http-post-form \
  "/dvwa/login.php:username=^USER^&password=^PASS^&Login=Login:Login failed"

-l one user, -L a user list; -p one password, -P a list; -t sets parallel tries. For a web form you must give the path, the parameters with ^USER^/^PASS^, and the text that appears on a failed login so Hydra knows what "wrong" looks like.

Online attacks are loud and often illegal

Hydra hammers a login and fills logs; against a real service it will trigger lockouts and alerts, and it is a crime without permission. Keep it on lab hosts.

Ravindra Bagale's Tip

For web forms, students get the failure string wrong, and then Hydra reports every password as "correct". First do one wrong login in the browser and copy the message you see (like "Login failed") exactly. If this one step is wrong, the whole attack is wasted.

Lab

Run Hydra against SSH on Metasploitable 2 with -l msfadmin and a small wordlist that includes msfadmin. Confirm it finds the password. Then, on your own EC2 server from Chapter 4, note that key-only SSH (password login disabled) makes this attack impossible – that is the fix.