← retour aux outils back to tools

# Hydra

Craqueur de connexions réseau rapide supportant des dizaines de protocoles : SSH, FTP, HTTP, SMB, et plus encore. Fast network login cracker supporting dozens of protocols — SSH, FTP, HTTP, SMB, and more.

↗ https://github.com/vanhauser-thc/thc-hydra

## Overview

Hydra is the go-to tool for online brute-force attacks against network services. It supports parallelised attacks across 50+ protocols.

## Common Usage

    # SSH
    hydra -l admin -P rockyou.txt ssh://10.10.10.1
    hydra -L users.txt -P passwords.txt ssh://10.10.10.1 -t 4

FTP

    hydra -l admin -P rockyou.txt ftp://10.10.10.1

HTTP POST form

    hydra -l admin -P rockyou.txt 10.10.10.1 http-post-form \
      "/login:username=^USER^&password=^PASS^:Invalid credentials"

HTTP GET (Basic Auth)

    hydra -l admin -P rockyou.txt http-get://10.10.10.1/admin

SMB

    hydra -L users.txt -P passwords.txt smb://10.10.10.1

RDP

    hydra -l administrator -P rockyou.txt rdp://10.10.10.1 -t 1

MySQL

    hydra -l root -P rockyou.txt mysql://10.10.10.1

## Tips

- Use `-t` to limit threads (some services lock after N failures)
- `-v` verbose, `-V` shows each attempt
- `-s <port>` to specify non-standard port
- For HTTP forms: inspect the login request in Burp to get the exact POST format and failure string

Help / Man page

    hydra [[[-l LOGIN|-L FILE] [-p PASS|-P FILE]] | [-C FILE]]
          [-e nsr] [-o FILE] [-t TASKS] [-M FILE] [-f] [-s PORT]
          [-x MIN:MAX:CHARSET] [-c TIME] [-ISOuvVd46]
          [-m MODULE-OPT] [service://server[:PORT][/OPT]]

    TARGET OPTIONS:
      -l LOGIN      Single username
      -L FILE       Username list
      -p PASS       Single password
      -P FILE       Password list
      -C FILE       Colon-separated login:pass file
      -M FILE       List of servers to attack

    SERVICE OPTIONS:
      service://server   e.g. ssh://10.10.10.1
      Supported: ftp, http-get, http-post-form, https-get,
                 https-post-form, smb, ssh, rdp, mysql,
                 mssql, postgres, smtp, pop3, imap, ...

    PERFORMANCE:
      -t TASKS      Parallel tasks per host (default: 16)
      -f            Stop after first valid pair found
      -F            Stop after first valid pair per host

    HTTP POST FORM FORMAT:
      "/path:post_data:failure_string"
      Use ^USER^ and ^PASS^ as placeholders
      Failure string: text that appears on failed login

    OTHER:
      -e n    Try empty password
      -e s    Try login as password
      -e r    Try reversed login as password
      -v      Verbose, -V show each attempt
      -o FILE Save found credentials to file

## Vue d’ensemble

Hydra est l’outil de référence pour les attaques par brute-force en ligne contre les services réseau. Il supporte des attaques parallélisées sur plus de 50 protocoles.

## Utilisation courante

    # SSH
    hydra -l admin -P rockyou.txt ssh://10.10.10.1
    hydra -L users.txt -P passwords.txt ssh://10.10.10.1 -t 4

    # FTP
    hydra -l admin -P rockyou.txt ftp://10.10.10.1

    # Formulaire POST HTTP
    hydra -l admin -P rockyou.txt 10.10.10.1 http-post-form \
      "/login:username=^USER^&password=^PASS^:Invalid credentials"

    # HTTP GET (Authentification Basic)
    hydra -l admin -P rockyou.txt http-get://10.10.10.1/admin

    # SMB
    hydra -L users.txt -P passwords.txt smb://10.10.10.1

    # RDP
    hydra -l administrator -P rockyou.txt rdp://10.10.10.1 -t 1

    # MySQL
    hydra -l root -P rockyou.txt mysql://10.10.10.1

## Conseils

- Utiliser `-t` pour limiter les threads (certains services bloquent après N échecs)
- `-v` verbeux, `-V` affiche chaque tentative
- `-s <port>` pour spécifier un port non standard
- Pour les formulaires HTTP : inspecter la requête de connexion dans Burp pour obtenir le format POST exact et la chaîne d’échec

Aide / Page de manuel

    hydra [[[-l LOGIN|-L FILE] [-p PASS|-P FILE]] | [-C FILE]]
          [-e nsr] [-o FILE] [-t TASKS] [-M FILE] [-f] [-s PORT]
          [-x MIN:MAX:CHARSET] [-c TIME] [-ISOuvVd46]
          [-m MODULE-OPT] [service://server[:PORT][/OPT]]

    TARGET OPTIONS:
      -l LOGIN      Single username
      -L FILE       Username list
      -p PASS       Single password
      -P FILE       Password list
      -C FILE       Colon-separated login:pass file
      -M FILE       List of servers to attack

    SERVICE OPTIONS:
      service://server   e.g. ssh://10.10.10.1
      Supported: ftp, http-get, http-post-form, https-get,
                 https-post-form, smb, ssh, rdp, mysql,
                 mssql, postgres, smtp, pop3, imap, ...

    PERFORMANCE:
      -t TASKS      Parallel tasks per host (default: 16)
      -f            Stop after first valid pair found
      -F            Stop after first valid pair per host

    HTTP POST FORM FORMAT:
      "/path:post_data:failure_string"
      Use ^USER^ and ^PASS^ as placeholders
      Failure string: text that appears on failed login

    OTHER:
      -e n    Try empty password
      -e s    Try login as password
      -e r    Try reversed login as password
      -v      Verbose, -V show each attempt
      -o FILE Save found credentials to file