Hydra Training Lab

What is Hydra?

THC Hydra is a parallelized network authentication cracker that supports numerous protocols to perform rapid dictionary attacks against login services. It is one of the most popular and powerful tools for testing the security of authentication mechanisms.

Originally developed by The Hacker's Choice (THC), Hydra can perform brute-force and dictionary-based attacks against more than 50 protocols including SSH, FTP, HTTP, HTTPS, SMB, RDP, MySQL, PostgreSQL, and many others. Its parallel processing capabilities make it exceptionally fast compared to sequential attack tools.

Why Learn Hydra?

• Security Testing: Validate password policies and authentication security in authorized penetration tests
• Defensive Understanding: Understand attack methodologies to implement better defenses (rate limiting, account lockouts, monitoring)
• Credential Recovery: Recover lost credentials on systems you own (with appropriate backups)
• Protocol Knowledge: Deepen understanding of various authentication protocols and their vulnerabilities
• Industry Standard: Hydra is widely used in professional security assessments and is essential knowledge for cybersecurity careers

Supported Protocols

Hydra supports an extensive array of protocols. Here are the most commonly tested:

Network Services

• SSH (Secure Shell): Port 22 - Remote administration protocol
• FTP (File Transfer Protocol): Port 21 - File transfer service
• Telnet: Port 23 - Unencrypted remote access (legacy)
• SMB/SAMBA: Port 445 - Windows file sharing protocol
• RDP (Remote Desktop Protocol): Port 3389 - Windows remote desktop
• VNC (Virtual Network Computing): Port 5900 - Remote desktop protocol

Database Services

• MySQL: Port 3306 - Popular open-source database
• PostgreSQL: Port 5432 - Advanced open-source database
• MSSQL: Port 1433 - Microsoft SQL Server
• Oracle: Port 1521 - Oracle database
• MongoDB: Port 27017 - NoSQL database

Web Services

• HTTP/HTTPS: Ports 80/443 - Web form authentication, basic auth, digest auth
• HTTP-POST-FORM: POST-based login forms (most common web logins)
• HTTP-GET-FORM: GET-based authentication

Email Protocols

• IMAP: Port 143/993 - Email retrieval
• POP3: Port 110/995 - Email retrieval
• SMTP: Port 25/587 - Email sending

Basic Syntax and Options

Core Command Structure

Essential Options

Example Commands

Advanced Techniques

Optimizing Attack Speed

The -t parameter controls parallel tasks. Higher values increase speed but may trigger security defenses or cause service disruption:

• Low (1-4 tasks): Stealthy, slower, less likely to trigger IDS/IPS
• Medium (8-16 tasks): Default, balanced approach
• High (32-64 tasks): Fast but noisy, may trigger defenses or crash services

Using Custom Wordlists

Effective wordlists are critical for success. Common wordlist locations:

Credential Pair Files

Use -C for pre-paired credentials (common default combinations):

Protocol-Specific Syntax

HTTP POST Form Attacks:

Defensive Countermeasures

Understanding Hydra attacks teaches you how to defend against them. Critical defenses include:

1. Account Lockout Policies

• Lock accounts after N failed attempts (typically 3-5)
• Implement temporary lockouts (5-15 minutes) before permanent locks
• Require administrator intervention for unlock on sensitive accounts

2. Rate Limiting

• Limit authentication attempts per IP address (e.g., 10 per minute)
• Implement exponential backoff (increasing delays after failures)
• Use CAPTCHA after repeated failures

3. Strong Password Policies

• Minimum 12-14 characters for administrative accounts
• Require complexity (uppercase, lowercase, numbers, symbols)
• Prohibit common passwords using breach databases
• Enforce password rotation for privileged accounts

4. Multi-Factor Authentication (MFA)

• Require second factor (SMS, authenticator app, hardware token)
• Makes brute-force attacks effectively impossible
• Critical for administrative and privileged access

5. Monitoring and Detection

• Monitor for multiple failed authentication attempts
• Alert on unusual authentication patterns (time, location, volume)
• Use SIEM systems to correlate authentication events
• Implement intrusion detection systems (IDS) to detect brute-force signatures

6. Network-Level Defenses

• Firewall rules limiting access to authentication services
• VPN requirements for administrative access
• IP whitelisting for critical services
• Fail2ban or similar automated blocking tools

Ethical and Legal Considerations

Legal Use Cases

• Authorized Penetration Testing: Written scope document, signed authorization, clearly defined boundaries
• Personal Systems: Your own servers, networks, and accounts (with backups)
• Controlled Lab Environments: Virtual machines, isolated networks, training platforms
• Bug Bounty Programs: Following published rules of engagement exactly

Professional Ethics

• Always obtain explicit written authorization before testing
• Clearly document scope, methods, and findings
• Protect confidential information discovered during testing
• Report vulnerabilities responsibly to asset owners
• Never exceed authorized scope or access data unnecessarily
• Maintain professional certifications and continuing education

Red Team vs. Black Hat

Red Teams are authorized security professionals who use offensive techniques to improve organizational security. They operate under strict legal agreements, professional ethics, and organizational policies.

Black Hats are malicious actors who perform unauthorized attacks for personal gain, disruption, or other illegal purposes. They face criminal prosecution, civil liability, and reputational destruction.

The technical skills may overlap, but the authorization, intent, and legal status are fundamentally different.