> For the complete documentation index, see [llms.txt](https://cajac.gitbook.io/ctf-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cajac.gitbook.io/ctf-notes/web/web-brute-forcing/brute-forcing-with-hydra.md). # Brute-forcing with Hydra ## Brute-forcing Examples ### HTTP POST Forms The general format of the parameters are ``` :: ``` Verbose brute-forcing of passwords for a specific user ```bash hydra -l -P 10.10.216.118 http-post-form "/:username=^USER^&password=^PASS^:F=incorrect" -V ``` Brute-forcing of both user and password on a non-standard port ```bash hydra -L users.txt -P common_passwords.txt 10.11.12.13 -s 8080 http-post-form "/login:username=^USER^&password=^PASS^:F=Invalid username or password" ``` ## Usage information
hydra -h ```bash ┌──(kali㉿kali)-[~] └─$ hydra -h Hydra v9.5 (c) 2023 by van Hauser/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway). Syntax: hydra [[[-l LOGIN|-L FILE] [-p PASS|-P FILE]] | [-C FILE]] [-e nsr] [-o FILE] [-t TASKS] [-M FILE [-T TASKS]] [-w TIME] [-W TIME] [-f] [-s PORT] [-x MIN:MAX:CHARSET] [-c TIME] [-ISOuvVd46] [-m MODULE_OPT] [service://server[:PORT][/OPT]] Options: -R restore a previous aborted/crashed session -I ignore an existing restore file (don't wait 10 seconds) -S perform an SSL connect -s PORT if the service is on a different default port, define it here -l LOGIN or -L FILE login with LOGIN name, or load several logins from FILE -p PASS or -P FILE try password PASS, or load several passwords from FILE -x MIN:MAX:CHARSET password bruteforce generation, type "-x -h" to get help -y disable use of symbols in bruteforce, see above -r use a non-random shuffling method for option -x -e nsr try "n" null password, "s" login as pass and/or "r" reversed login -u loop around users, not passwords (effective! implied with -x) -C FILE colon separated "login:pass" format, instead of -L/-P options -M FILE list of servers to attack, one entry per line, ':' to specify port -o FILE write found login/password pairs to FILE instead of stdout -b FORMAT specify the format for the -o FILE: text(default), json, jsonv1 -f / -F exit when a login/pass pair is found (-M: -f per host, -F global) -t TASKS run TASKS number of connects in parallel per target (default: 16) -T TASKS run TASKS connects in parallel overall (for -M, default: 64) -w / -W TIME wait time for a response (32) / between connects per thread (0) -c TIME wait time per login attempt over all threads (enforces -t 1) -4 / -6 use IPv4 (default) / IPv6 addresses (put always in [] also in -M) -v / -V / -d verbose mode / show login+pass for each attempt / debug mode -O use old SSL v2 and v3 -K do not redo failed attempts (good for -M mass scanning) -q do not print messages about connection errors -U service module usage details -m OPT options specific for a module, see -U output for information -h more command line options (COMPLETE HELP) server the target: DNS, IP or 192.168.0.0/24 (this OR the -M option) service the service to crack (see below for supported protocols) OPT some service modules support additional input (-U for module help) Supported services: adam6500 asterisk cisco cisco-enable cobaltstrike cvs firebird ftp[s] http[s]-{head|get|post} http[s]-{get|post}-form http-proxy http-proxy-urlenum icq imap[s] irc ldap2[s] ldap3[-{cram|digest}md5][s] memcached mongodb mssql mysql nntp oracle-listener oracle-sid pcanywhere pcnfs pop3[s] postgres radmin2 rdp redis rexec rlogin rpcap rsh rtsp s7-300 sip smb smtp[s] smtp-enum snmp socks5 ssh sshkey svn teamspeak telnet[s] vmauthd vnc xmpp Hydra is a tool to guess/crack valid login/password pairs. Licensed under AGPL v3.0. The newest version is always available at; https://github.com/vanhauser-thc/thc-hydra Please don't use in military or secret service organizations, or for illegal purposes. (This is a wish and non-binding - most such people do not care about laws and ethics anyway - and tell themselves they are one of the good ones.) These services were not compiled in: afp ncp oracle sapr3 smb2. Use HYDRA_PROXY_HTTP or HYDRA_PROXY environment variables for a proxy setup. E.g. % export HYDRA_PROXY=socks5://l:p@127.0.0.1:9150 (or: socks4:// connect://) % export HYDRA_PROXY=connect_and_socks_proxylist.txt (up to 64 entries) % export HYDRA_PROXY_HTTP=http://login:pass@proxy:8080 % export HYDRA_PROXY_HTTP=proxylist.txt (up to 64 entries) Examples: hydra -l user -P passlist.txt ftp://192.168.0.1 hydra -L userlist.txt -p defaultpw imap://192.168.0.1/PLAIN hydra -C defaults.txt -6 pop3s://[2001:db8::1]:143/TLS:DIGEST-MD5 hydra -l admin -p password ftp://[192.168.0.0/24]/ hydra -L logins.txt -P pws.txt -M targets.txt ssh ```
hydra http-post-form -U ```bash ┌──(kali㉿kali)-[~] └─$ hydra http-post-form -U Hydra v9.5 (c) 2023 by van Hauser/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway). Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2025-08-08 09:40:22 Help for module http-post-form: ============================================================================ Module http-post-form requires the page and the parameters for the web form. By default this module is configured to follow a maximum of 5 redirections in a row. It always gathers a new cookie from the same URL without variables The parameters requires at a minimum three ":" separated values, plus optional values. (Note: if you need a colon in the option string as value, escape it with "\:", but do not escape a "\" with "\\".) Syntax: :
[:[:]: First is the page on the server to GET or POST to (URL), e.g. "/login". Second is the POST/GET variables (taken from either the browser, proxy, etc.) without the initial '?' character and the usernames and passwords being replaced with "^USER^" ("^USER64^" for base64 encodings) and "^PASS^" ("^PASS64^" for base64 encodings). Third are optional parameters (see below) Last is the string that it checks for an *invalid* login (by default). Invalid condition login check can be preceded by "F=", successful condition login check must be preceded by "S=". This is where most people get it wrong! You have to check the webapp what a failed string looks like and put it in this parameter! Add the -d switch to see the sent/received data! Note that using invalid login condition checks can result in false positives! The following parameters are optional and are put between the form parameters and the condition string; seperate them too with colons: 2= 302 page forward return codes identify a successful attempt (c|C)=/page/uri to define a different page to gather initial cookies from (g|G)= skip pre-requests - only use this when no pre-cookies are required (h|H)=My-Hdr\: foo to send a user defined HTTP header with each request ^USER[64]^ and ^PASS[64]^ can also be put into these headers! Note: 'h' will add the user-defined header at the end regardless it's already being sent by Hydra or not. 'H' will replace the value of that header if it exists, by the one supplied by the user, or add the header at the end Note that if you are going to put colons (:) in your headers you should escape them with a backslash (\). All colons that are not option separators should be escaped (see the examples above and below). You can specify a header without escaping the colons, but that way you will not be able to put colons in the header value itself, as they will be interpreted by hydra as option separators. Examples: "/login.php:user=^USER^&pass=^PASS^:incorrect" "/login.php:user=^USER64^&pass=^PASS64^&colon=colon\:escape:S=result=success" "/login.php:user=^USER^&pass=^PASS^&mid=123:authlog=.*failed" "/:user=^USER&pass=^PASS^:H=Authorization\: Basic dT1w:H=Cookie\: sessid=aaaa:h=X-User\: ^USER^:H=User-Agent\: wget" "/exchweb/bin/auth/:F=failedowaauth.dll:destination=http%3A%2F%2F%2Fexchange&flags=0&username=%5C^USER^&password=^PASS^&SubmitCreds=x&trusted=0:C=/exchweb":reason= ```
## Resource Hydra - Kali Tools: THC-Hydra - GitHub: