Command library / hydra

Online password-guessing tool for authorised tests

Hydra tries many logins and passwords against a network service such as SSH, FTP or HTTP forms. Lowercase options take ONE value (-l login, -p password); capital options take a FILE (-L logins, -P passwords). One account with many passwords is a dictionary/brute-force attack; one password across many accounts is password spraying.

Usage

Options and flags

• service://target

  protocol and host to attack, e.g. ssh://10.10.10.5

• -l LOGIN

  a single username

• -L FILE

  a file of usernames

• -p PASS

  a single password

• -P FILE

  a file of passwords (the password list)

• -t TASKS

  number of parallel connections (default 16)

• -s PORT

  non-default service port

• -f

  stop as soon as one valid login is found

• -V

  verbose: show every attempt

• -o FILE

  write the found credentials to a file

Examples

• hydra -l admin -P wordlist.txt ssh://10.10.10.5

  One account, many passwords (dictionary attack) against SSH.

• hydra -L users.txt -p Winter2026 ssh://10.10.10.5

  One password across many accounts: password spraying.

• hydra -l admin -P wordlist.txt -t 4 ssh://10.10.10.5

  Four parallel tasks — gentler on a fragile lab host.

• hydra -l admin -P wordlist.txt -f ssh://10.10.10.5

  Stop at the first valid pair.

Common mistakes

Related commands