root@thehacksparrow:~/writeups$ SYSTEM ONLINE
· log in sign up
← back to cheatsheets
root@sparrow:~/writeups$ cat hydra.md
// cracking

Hydra

21 Jul 2026 · 7 min read
crackingcheatsheetshydra
Hydra (often thc-hydra) is an online credential cracker that tests usernames and passwords against a live service. It supports dozens of protocols —SSH, FTP, HTTP, RDP, SMB, MySQL and more— with fast, parallel attacks. It is the go-to tool for demonstrating the real impact of a weak password.

Hydra is online: every attempt is a real connection to the service, so network latency and server-side limits —not your CPU— set the pace. Raising threads with -t speeds things up, but too many trigger lockouts, false negatives or a service crash. The trick is choosing the right module, wordlist and parallelism, not blind brute force.

1. Beginner level — per-service attacks

HYDRA cheat sheet — Beginner
CommandWhat it does
hydra -l user -P <wl> <t> sshSSH brute force with a fixed username
hydra -L <users> -p pass <t> ftpFTP brute force with a fixed password
hydra -L <users> -P <wl> <t> sshCombines a username list and a password list
hydra -l admin -P <wl> <t> http-get /loginBrute force against an HTTP GET login
hydra -l admin -P <wl> <t> http-post-form "..."Brute force against a POST form
hydra -L <users> -P <wl> <t> mysqlBrute force against MySQL
hydra -L <users> -P <wl> <t> rdpBrute force against RDP
hydra -l user -P <wl> <t> smbBrute force against SMB
hydra -V -l user -P <wl> <t> sshVerbose mode: shows every attempt
hydra -o out.txt -l user -P <wl> <t> sshSaves results to a file
hydra -t 4 -l user -P <wl> <t> sshLimits the number of parallel threads
hydra -f -l user -P <wl> <t> sshStops on finding the first credential
hydra -e nsr -l user <t> sshTries empty, same as user, and reversed
hydra -s 2222 -l user -P <wl> <t> sshSpecifies a non-standard port

2. Advanced level — multi-target and fine control

HYDRA cheat sheet — Advanced
CommandWhat it does
hydra -C user_pass.txt <t> sshUses a combined username:password list
hydra -M targets.txt -l user -P <wl> sshAttacks several targets from a file
hydra -l user -P <wl> <t> ssh -t 16 -w 30Tunes threads and wait time
hydra -l user -P <wl> -s 443 <t> https-get /HTTPS brute force on a custom port
hydra -RResumes a previously interrupted attack
hydra -l user -P <wl> <t> smtp -vSMTP brute force in verbose mode
hydra -L <users> -P <wl> <t> postgresBrute force against PostgreSQL
hydra -L <users> -p '' <t> ssh -e nTests only an empty password across several users
hydra -l user -x 4:8:a <t> sshGenerates passwords by pure brute force
hydra -l user -P <wl> <t> ssh -4Forces the use of IPv4
hydra -U http-post-formShows the specific help for a module
hydra -l user -P <wl> <t> ssh -o out.json -b jsonExports the results in JSON format
hydra -l user -P <wl> <t> ssh6SSH brute force over IPv6
hydra -l user -P <wl> <t> ssh -IIgnores a previously restored session

3. Details people miss

  • The service module ALWAYS goes at the end of the line (ssh, ftp, http-post-form): it is a positional argument, not a flag.
  • In http-post-form the three-part string (path:parameters:failure-condition) is the trickiest bit; use ^USER^ and ^PASS^ plus a failure marker that appears in the wrong-login response.
  • More threads is not always better: SSH often breaks above -t 4 due to server limits (MaxStartups), and aggressive parallelism triggers account lockouts and false negatives.
  • Use -f to stop at the first valid credential and -o to save the output; on real targets, check lockout policies first so you don't take accounts out of service.
  • Mind the case: -l/-p take a single value, while -L/-P expect a list file.

Responsible use

These commands are for systems you own or have explicit written authorisation to test (labs, CTFs, contracted engagements). Using them against third-party infrastructure without permission is illegal in most countries.