How to Use Hydra For Dictionary Attack

Today we're going to go over hydra and we're going to do some brute force cracking because it can be

very fruitful in your venture and penetration-testing a lot of times users very use very weak passwords and simple brute-force attacks can gain access can allow you to gain access so without further ado let's just jump into it and get going all right so hydra camera is a command-line tool but there's also a GUI front-end I generally prefer to use the it kind of depends on the situation a lot of the times I end up using the GUI interface through Sparta that's because I just already used Sparta to do a lot of enumerated so it's just handy if I'm already in there to just fire it off but in some instances, if I'm trying to do specialized tax very focused attacks I'll do it through command line and often I will run multiple Hydra sessions for specific users that way I'm getting more productivity out of it in a certain amount of time but anyways we'll get into that a future article that's more advanced cracking.

But for basics let's just get started and type Hydra and we can see here are our command-line options so feel free pause the article take a read to have fun I'm gonna go ahead and just type in the command that I like to use so we're going to start off with Hydra we're gonna do - s where our port and we're going to in this article we're gonna be cracking SSH so that's gonna be port 22 we're gonna do - lowercase V and I will show you the difference between a lower base lowercase V in an uppercase v it basically is the amount of verbosity you'll get back let's see alright so - q is supposed to stop errors but seems like it doesn't work for me anyway so I'm gonna do - capital L because this is going to capital L means you want to use a login or excuse me capital L means you want to use a file full of logins.

If you were to use a lowercase L you would then type one login name here so for example if you wanted to just try to crack the root login you would do a lowercase L root but let's say you had a whole bunch of users that you were trying to crack and you had them in a file like I do I'm actually I'm in the wrong folder so let's go get rid of this old file okay so I had a password file and I basically just ripped out all the user accounts and just created this file here that's basically just each user account on one line and then I'm going to feed this into Hydra and it's going to try to crack all of these accounts alright so let's get back to where we were port 22 low verbosity quiet airs a user file and that filename is password and then we're gonna do a password file we're gonna do user share where this rock you then we're going to dude II and then in means, we're gonna try our logins with no password s means we're gonna try the password we're gonna try the login name as the password and then our means we're gonna try the login reversed as the password attack t-that is going to be how many threads you spawned.

In this instance I'm just gonna launch nine threads attack w5 that's basically going to be your timeout so we want to wait five seconds and then you're going to do your host IP in this instance I just have SSH running on my localhost here and then the protocol SSH and that could be FTP any protocol that Hydra supports all right so we're gonna go ahead and hit enter this is going to take a little bit of time so I'm gonna speed up the article a little bit but I'm just going to let this run with the lowercase V so you see what kind of output you get with that once it's finished then we'll do it again with the uppercase v so you can see the high verbosity alright so let's get going you all right so now let's do the same command but this time with the capital V and let's run it you and there we have it the very last password cracked so as you can see by doing the capital V it shows you every single login attempt and that can be very helpful if you're trying to debug or confirm that it's actually doing what you think it should be doing because you want to make sure it's trying the passwords because if it's not trying them you could be messing out alright guys so that's gonna do it for this article be sure to LIKE and subscribe and come back to watch more articles and I will see you guys next time.