Hydra: Online Password Brute Forcing with SSH and Web Forms

Introduction

Welcome to my walkthrough of the TryHackMe room Hydra! This is the first room in the Offensive Security Tooling module of the Cyber Security 101 path.

In my previous article, Burp Suite: The Basics, we wrapped up the entire Web Hacking module, covering Burp Suite's core toolset, proxying traffic through FoxyProxy, scoping a target, and bypassing a client side filter to land a reflected XSS payload. This room shifts focus entirely: instead of inspecting and manipulating traffic by hand, we're putting automated credential brute forcing to work against live login services using Hydra, one of the most widely used online password cracking tools in the field.

If you missed the previous entry in this series, you can catch up on my walkthrough for Burp Suite: The Basics below.

What we will cover

• What Hydra is, and the wide range of protocols it can brute force
• Why weak, default, or overly common passwords remain such an easy target
• Constructing a basic Hydra command against SSH with a username and wordlist
• Brute forcing a POST based web login form, including how to read the failure condition
• Answers to every question in the room

Room Information

Before we dive into the tasks, here is a quick overview of the room details.

• Room Name: Hydra
• Path: Cyber Security 101
• Module: Offensive Security Tooling
• Topic: Online Password Brute Forcing, SSH, and Web Form Authentication
• Difficulty: Easy
• Room Link: TryHackMe — Hydra

Task 1: Hydra Introduction

Hydra is an online password brute forcing tool, built to automate the otherwise tedious process of guessing login credentials against a live authentication service. Rather than manually trying password after password against an SSH server, a web login form, or an FTP service, Hydra works through a supplied wordlist at speed, testing each candidate against the target until it finds one that succeeds.

Hydra's real strength lies in just how many protocols it supports. According to its official repository, Hydra can brute force an extensive list of services, including SSH (v1 and v2), FTP, RDP, SMB, Telnet, VNC, SNMP, POP3, IMAP, MySQL, MS-SQL, LDAP, and a full range of HTTP and HTTPS form and authentication types, among many others. For a complete breakdown of the options available for each protocol, the Kali Hydra tool page is worth bookmarking as a reference.

This breadth is exactly why weak passwords remain such a persistent problem. A password that's short, common, or missing special characters falls quickly to a large wordlist like rockyou.txt, which bundles millions of real, previously breached passwords. Out of the box devices and applications are a particularly easy target here: CCTV cameras, routers, and web frameworks are notorious for shipping with default credentials like admin:password, and if that default is never changed, Hydra (or any equivalent tool) makes short work of it.

Task 2: Using Hydra

Hydra comes pre-installed on the AttackBox, so no setup is required there. On other distributions, it's readily available through standard package managers, installable on Ubuntu or Fedora with apt install hydra or dnf install hydra respectively, or built directly from the official Hydra repository if a specific version is needed.

The exact options passed into Hydra change depending on which protocol is being targeted, but the underlying shape of the command stays consistent: a username (or username list), a password list, and the target service. Against SSH, a typical command looks like this:

hydra -l <username> -P <full path to pass> MACHINE_IP -t 4 ssh

hydra -l <username> -P <full path to pass> MACHINE_IP -t 4 ssh

Here, -l specifies the username to authenticate as, -P points to the password wordlist, and -t sets how many threads run in parallel, trading speed for noise in the same way a higher thread count would on any brute forcing tool. Running hydra -l root -P passwords.txt MACHINE_IP -t 4 ssh, for example, tries every password in passwords.txt against the root account over SSH, four attempts at a time.

Brute forcing a web login form follows the same overall pattern, but requires knowing the exact shape of the HTTP request first, information easily found using a browser's developer tools network tab or by reading the page's source. For a POST based login form, the command takes this general structure:

hydra -l <username> -P <wordlist> MACHINE_IP http-post-form "<path>:<login_credentials>:<invalid_response>"

hydra -l <username> -P <wordlist> MACHINE_IP http-post-form "<path>:<login_credentials>:<invalid_response>"

The <path> is the login page's URL (often just /), <login_credentials> defines the form fields with ^USER^ and ^PASS^ standing in for whatever Hydra is currently testing, and <invalid_response> is a string that only appears in the server's reply when a login attempt fails, letting Hydra tell a wrong guess apart from a correct one. A concrete example looks like this:

hydra -l <username> -P <wordlist> MACHINE_IP http-post-form "/:username=^USER^&password=^PASS^:F=incorrect" -V

hydra -l <username> -P <wordlist> MACHINE_IP http-post-form "/:username=^USER^&password=^PASS^:F=incorrect" -V

The F=incorrect portion tells Hydra to treat any response containing the word "incorrect" as a failed login, while -V prints verbose output for every single attempt as it happens. If the target web server listens on a non default port, -s <port> slots into the same command to point Hydra at the right destination.

Guided Walkthrough: Brute Forcing the Web Login and SSH

To simplify navigation during the room, mapped the deployment's target address to MACHINE_IP inside the local /etc/hosts file as an optional setup step.

With the hostname configured, navigating to http://MACHINE_IP/login in the browser brought up the target's web authentication portal. Submitting a test login with intentional dummy credentials revealed the exact form path (/login) and triggered the failure string: Your username or password is incorrect..

Armed with the form parameters and the failure message, constructed the full Hydra command to brute force molly's web password using rockyou.txt: hydra -l molly -P /usr/share/wordlists/rockyou.txt MACHINE_IP http-post-form "/login:username=^USER^&password=^PASS^:F=Your username or password is incorrect." -V

Hydra began testing candidates sequentially until it hit a valid pair, outputting the successfully identified web password directly in the terminal window.

Logging into http://MACHINE_IP/login using molly's newly discovered web credentials granted access to the protected area, displaying the first flag prominently on the landing page.

Switching focus to SSH access, initiated a second Hydra attack against the target's SSH service using molly's username, rockyou.txt, and 4 parallel threads via -t 4: hydra -l molly -P /usr/share/wordlists/rockyou.txt MACHINE_IP -t 4 ssh

With the SSH credentials in hand, established a remote shell session as molly with ssh molly@MACHINE_IP and retrieved the final flag using cat flag2.txt inside her home directory.

Questions and Answers

Use Hydra to brute force molly's web password. What is the value of flag 1?

Answer:

THM{2673a7dd116de68e85c48ec0b1f2612e}

THM{2673a7dd116de68e85c48ec0b1f2612e}

Use Hydra to brute force molly's SSH password. What is the value of flag 2?

Answer:

THM{c8eeb0468febbadea859baeb33b2541b}

THM{c8eeb0468febbadea859baeb33b2541b}

Summary & Key Takeaways

That wraps up Hydra! A short, practical room, but one that makes an important point stick: no matter how many defenses sit in front of a login form or an SSH service, a weak or common password undoes all of it the moment a wordlist attack is pointed at it.

Key lessons:

• Hydra automates online password brute forcing across an enormous range of protocols, from SSH and FTP to web login forms over HTTP and HTTPS.
• The core syntax stays consistent across protocols: a username (-l), a password list (-P), and the target service, with protocol specific options layered on top.
• Brute forcing a web login form requires knowing the exact request path, the form field names, and a reliable failure string (F=) so Hydra can tell a wrong guess from a correct one.
• Weak, common, or default credentials remain trivially breakable with a large wordlist like rockyou.txt, which is exactly why strong, unique passwords matter on every service, not just the obviously sensitive ones.

Next up is Gobuster: The Basics, where we put directory and file brute forcing to work uncovering hidden content on a web server. Click the banner below to check it out!

If you found this walkthrough helpful, consider following me here on Medium to catch the next room analysis in this series.

You can also connect with me and follow my work across other platforms:

• 💼 LinkedIn
• 🐦 X (Twitter)