_ ReconLab
Commands  / Password Attacks  / Hydra

Hydra

Fast online brute-force for many protocols.

KaliParrothigh

pkg: hydra

THC-Hydra performs parallel online password attacks against dozens of protocols (SSH, FTP, HTTP forms, RDP, SMB and more).

Syntax

hydra -l {user} -P {wordlist} {service}://{host}

Example

hydra -l admin -P rockyou.txt ssh://10.0.0.5

Brute-forces SSH for user admin using the rockyou wordlist.

Options & flags

What each switch does. Toggle them in the builder below to assemble a command.

-l <admin>Single username to try.
-L <users.txt>File containing usernames.
-p <Password1>Single password to try.
-P <rockyou.txt>File containing passwords (wordlist).
-s <2222>Custom port for the service.
-t <4>Parallel tasks/threads (lower to avoid lockouts).
-fStop after the first valid login is found.
-VVerbose — show every login attempt.
-o <found.txt>Write found credentials to a file.
-IIgnore restore file (fresh start).

Command builder

Tick options (and fill any values) to build a ready-to-copy command.

hydra SERVICE://HOST

Usage examples

hydra -l admin -P rockyou.txt ssh://10.0.0.5

Brute-force SSH for user admin.

hydra -L users.txt -P pass.txt ftp://10.0.0.5 -t 4 -f

Try user/pass lists against FTP, stop on first hit.

hydra -l admin -P pass.txt 10.0.0.5 http-post-form "/login:user=^USER^&pass=^PASS^:Invalid"

Brute-force an HTTP login form.

Advantages
  • Supports a huge range of protocols
  • Highly parallel and fast
  • Flexible form/login handling
Disadvantages
  • Triggers lockouts and alerts
  • Very loud in logs
  • Slow against rate-limited services
Tags
#brute-force#online#credentials

Official docs: Hydra ↗

Related commands

Medusa

Parallel, modular online brute-forcer.

Ncrack

High-speed network authentication cracker (Nmap project).

Frequently asked questions

What is Hydra used for?
THC-Hydra performs parallel online password attacks against dozens of protocols (SSH, FTP, HTTP forms, RDP, SMB and more).
What is an example Hydra command?
A common example is: hydra -l admin -P rockyou.txt ssh://10.0.0.5 — Brute-forces SSH for user admin using the rockyou wordlist.
Is Hydra part of Kali Linux?
Yes. Hydra ships with Kali Linux (and Parrot OS). If missing, install it with: sudo apt install hydra.
What category of security tool is Hydra?
Hydra is a Password Attacks tool with a high-risk profile when run against a live target.

Try recon tools live

Run real scans against a domain you control, stage by stage.

Open the lab →