Hydra — login brute-forcing

In a nutshell Hydra automates trying many passwords against a login until one works. Point it at a service (SSH, FTP, a web form…), give it usernames and a wordlist, and it hammers combinations fast. The go-to when a service has weak or reused credentials and no protection against guessing.

Online vs offline — a crucial split

Online (Hydra)

real login attempts to the live service
needs no stolen hash — just a reachable login
slow, noisy, blockable

Offline (hashcat / John)

guessing against a stolen hash on your machine
needs the hash first
fast, silent, unstoppable once you have it

Analogy. Offline is taking a copy of the lock home and filing keys in peace. Online (Hydra) is standing at the real door trying key after key — faster to start, but the doorman sees you and can stop you.

The shape of a command

Always: who (users), what to try (passwords), where (host + service).

hydra -l alice -P rockyou.txt ssh://10.10.10.5           # one user, a wordlist
hydra -L users.txt -P rockyou.txt ftp://10.10.10.5       # many users AND passwords
hydra -l admin -P rockyou.txt 10.10.10.5 http-post-form \
  "/login:username=^USER^&password=^PASS^:Invalid credentials"   # a web form

Flag	Meaning
`-l` / `-L`	one login / a file of logins
`-p` / `-P`	one password / a wordlist
`-t`	parallel tasks (speed; too high breaks fragile services)
`-f`	stop at the first valid pair

The web-form string, decoded

"/login:username=^USER^&password=^PASS^:Invalid credentials" has three colon-separated parts: the path, the body with ^USER^/^PASS^ markers Hydra fills, and a failure string — text shown only on a failed login. Hydra knows it won! the failure text is absent. Capture the exact request in Burp first to get this right.

Brute-force is only as good as its list

Brute-force

many passwords vs one user
trips per-account lockout fast

Password spraying

one common password vs many users
dodges lockout — stealthier

rockyou.txt (millions of real leaked passwords) is the classic starting list; smarter attacks tailor it to the target (company name, seasons, years).

Why it works, and how it dies It works because humans pick weak, reused passwords. It dies against the controls from Authentication & sessions: rate-limiting + lockout make each guess cost time; MFA means a correct password alone isn't enough; a strong policy pushes the real password off the end of any wordlist. A spike of failed logins from one source is Hydra's signature — which is why monitoring catches it. Labs and authorized tests only.