This post was originally published in French only. We translated it in 2026 so the archive reads the same in both languages. Read the original →


The Backtrack 101 series aims to introduce beginners to several tools distributed with Backtrack Linux. By following these articles, a beginner can participate in the hackfest challenges and begin learning penetration testing techniques.


In this third article, we'll discuss a tool called hydra.

Official project website: http://www.thc.org/thc-hydra/

Overview:


The hydra tool can be used to attack (almost) all types of login systems. Whether it's an FTP, SSH, web form, or other login, hydra can be used to attempt to find a user's username and password. Fortunately for the attacker, hydra supports the use of multiple processors to increase the speed of an attack.

How does it work?


Hydra can be used in two ways:

  1. Brute force (we love good French)
  2. Dictionary Attack


In the first case—a brute-force attack—the tool generates the passwords to be used during the attack on its own. The advantage of this is that "all" possible combinations can be tested during the attack. Unfortunately, a brute-force attack can take much longer; however, it is more likely to succeed. Unlike a brute-force attack, a dictionary attack will use only the words present in a given list. During such an attack, you are therefore limited to the words in the list. A dictionary attack will be faster. It's also generally possible to focus our efforts on certain aspects of the targeted user during such an attack (we'll come back to this!).

The Basics


For the sake of this example, since my test environment has only one SSH server and one HTTP server, we'll start by targeting SSH. To keep this from taking too long, I've prepared a short list of words in the smallTestList file created for this purpose. Here is the contents of that file:

This list contains the root user's password for the test environment. Since it's short, hydra will discover the root user's password very quickly. To use the list in an attack, simply run the following command:

root@bt:# hydra 192.168.1.1 ssh -P smallTestList -l root

When the command is executed, hydra will try all the passwords in the list by pairing them with the root username, as explained by the list of options used in this command:


Thus, the four passwords in the list will be used to find the root user's password. When the command is executed, hydra successfully discovers the password, as shown in the following figure:

Hydra has therefore found the password 12345 for the user root on the host 192.168.1.1. That is indeed the correct password! Hydra could also be used in other situations. For example, it could be used with a web form. For the purposes of this example, I created a simple web authentication form that accepts the user admin with the password 12345. Here is the form in question:

Using hydra on a web form requires a brief analysis of the form in question. To run hydra, you must first identify which form parameters need to be configured. Here is the HTML code for our form:

We can see that the username and password parameters are named username and password, respectively. To carry out the attack successfully, we also need a piece of information that won't appear on the page after a successful authentication. In our case, it's a safe bet that please login won't be on the page once authentication is successful. Armed with this information, we can begin the attack. Here is the command that should be used to attack this web form:

root@bt:# hydra 192.168.1.1 -l admin -P smallTestList http-post-form "/test.php:username=^USER^&password=^PASS^:please login"

Before running the command, let's look at how it's structured.


Thus, executing this command on the web authentication form will yield the following result:

As can be seen, hydra successfully found the password.

Important Considerations


Note: The information in this section is not intended as a countermeasure against the hydra tool but simply as an important consideration for users of the tool. We do NOT recommend this measure to counter a potential attack by a tool like hydra on a web form.

In the previous example, the string please login was used by hydra to detect that authentication was successful. The tool therefore expects not to find this string in the event of a successful login. The example works well, but for it to work, the string please login must absolutely not be present when authentication is successful. Thus, if the programmer, in an attempt to counter a tool like hydra, had added the HTML comment:

to the page following a user's authentication, the string would be present on the page but invisible to the user. The hydra tool would therefore be unable to determine whether authentication was successful, as shown in the following figure, which depicts a hydra attack on a page containing please login as an HTML comment after the user's authentication:

In this situation, another string would need to be found that could be used to validate the success of the attack.

Supported Protocols


Hydra supports several protocols. Here is a non-exhaustive list of protocols supported by hydra:

Wordlists in BackTrack


As we've seen so far, wordlists play a key role in using the hydra tool. Fortunately, the backtrack distribution contains several wordlists, located primarily in the /pentent/passwords/wordlist directory. These wordlists contain a wide variety of words that can be used during an attack with hydra. However, in certain situations, you might want to use a custom wordlist tailored to your target. Let's imagine the following scenario:


This information, which you could very well have found on social media, is likely to be included in Mr. Doe's password. Backtrack includes a tool for generating a list of potential passwords based on information about the target. This tool is called cupp. You can find it in the /pentest/passwords/cupp directory. We won't go into detail about how to use the tool; we'll just cover its basic usage. You can run the tool using the command:

root@bt:# ./cupp.py -i

When you're inside the cupp directory.

This command will launch an interactive mode in which the tool will ask us a series of questions about our target, as shown in the following figure:

After execution, the cupp tool generates a list of 35,776 words for the purpose of launching a targeted attack against an individual. The attack will therefore have a greater chance of success. The generated list is located in the cupp directory once the tool has finished running.

Final Thoughts


As we've seen, hydra offers a wealth of interesting features for attacking various protocols to discover valid usernames and passwords. However, special care must be taken when customizing the command to ensure that it works exactly as intended. Furthermore, using a word list that is well-suited to the situation is essential for the attack's success. For example, using a list of French words on a site that is exclusively in English will have a lower chance of success. With that said, I hope you enjoy exploring!

Did you like this article?


Would you like to read an article about a tool you're not familiar with? Just leave the name of the tool in the comments—if it's available in Backtrack, an article will be written about it.

The Backtrack 101 series aims to introduce beginners to several tools distributed with Backtrack Linux. By following these articles, a beginner can easily participate in the hackfest challenges and begin learning penetration testing techniques.