Monday, May 12, 2025
HomePassword CrackingOnline Password Bruteforce Attack With THC-Hydra Tool

Online Password Bruteforce Attack With THC-Hydra Tool

Published on

SIEM as a Service

Follow Us on Google News

According to Kali, THC-Hydra Tool is a parallelized login cracker that supports numerous protocols to attack. It is very fast and flexible, and new modules are easy to add.

This Tool makes it possible for researchers and security consultants to show how easy it would be to gain unauthorized access to a system remotely.

It supports: Cisco AAA, Cisco auth, Cisco enable, CVS, FTP, HTTP(S)-FORM-GET, HTTP(S)-FORM-POST, HTTP(S)-GET, HTTP(S)-HEAD, HTTP-Proxy, ICQ, IMAP, IRC, LDAP, MS-SQL, MySQL, NNTP, Oracle Listener, Oracle SID, PC-Anywhere, PC-NFS, POP3, PostgreSQL, RDP, Rexec, Rlogin, Rsh, SIP, SMB(NT), SMTP, SMTP Enum, SNMP v1+v2+v3, SOCKS5, SSH (v1 and v2), SSHKEY, Subversion, Teamspeak (TS2), Telnet, VMware-Auth, VNC and XMPP.

Also Read : Offline Password Cracking with John the Ripper – Tutorial

- Advertisement - Google News

THC-Hydra Tool will work in 4 modes:

  • One username & one password
  • User list & One password
  • One username & Password list
  • User list & Password list

Hydra has Various Options:

  • Target – Settings of various target options
  • Passwords – Specify password options & wordlists
  • Tuning – Specify how fast should hydra work. Other timing options are also available.
  • Specific – For testing on specific targets like a domain, https proxy, etc.
  • Start – Start/Stop & shows the output.

Step 1:

Find the Hydra from Kali by searching xHydra.

Here we are setting our Target IP “192.268.0.103”(set your Remote Target) In the Target area.

we are using SSH authentication for communicating to remote Target “192.268.0.103”

Target: “192.268.0.103”  Protocol : SSH

Bottom of the tool we can see the command line which automatically Create when we set out settings in the GUI of THC-Hydra

THC-Hydra Tool

Step 2:

we Perform a wordlist attack by using a wordlist containing the most common passwords to break into the root account. you can add an “n” number of passwords to your word list.

In the Passwords area, we set our username as “root” and specified our wordlist.txt location in the password list box(/root/password/txt).

Kali Linux comes with built-in word lists.

Search them using the command: locate *.lst in the terminal.

command: locate *.lst
THC-Hydra Tool

Step 3:

In the Tuning area, we set the number of tasks that we are going to perform.

I set 1 task for the Attack.

you can set the proxy as No Proxy.

THC-Hydra Tool

Step 4:

we can go ahead and trigger the start attachment by Clicking the start button.

THC-Hydra Tool

you can see clearly  the terminal command line at the bottom of the tool which is about the target IP, a protocol that we used, and wordlist of dictionary list  (password.txt)

THC-Hydra Tool

Finally, e have got the result about our target system login ID and password

  • Login ID: root
  • Password: toor

Also Read:

Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Latest articles

Kimsuky Hacker Group Deploys New Phishing Techniques and Malware Campaigns

The North Korean state-sponsored Advanced Persistent Threat (APT) group Kimsuky, also known as “Black...

APT37 Hackers Use Weaponized LNK Files and Dropbox for Command-and-Control Operations

The North Korean state-sponsored hacking group APT37, also known as ScarCruft, launched a spear...

Open Source Linux Firewall IPFire 2.29 – Core Update 194 Released: What’s New!

IPFire, the powerful open-source firewall, has unveiled its latest release, IPFire 2.29 – Core...

Threat Actors Leverage DDoS Attacks as Smokescreens for Data Theft

Distributed Denial of Service (DDoS) attacks, once seen as crude tools for disruption wielded...

Resilience at Scale

Why Application Security is Non-Negotiable

The resilience of your digital infrastructure directly impacts your ability to scale. And yet, application security remains a critical weak link for most organizations.

Application Security is no longer just a defensive play—it’s the cornerstone of cyber resilience and sustainable growth. In this webinar, Karthik Krishnamoorthy (CTO of Indusface) and Phani Deepak Akella (VP of Marketing – Indusface), will share how AI-powered application security can help organizations build resilience by

Discussion points


Protecting at internet scale using AI and behavioral-based DDoS & bot mitigation.
Autonomously discovering external assets and remediating vulnerabilities within 72 hours, enabling secure, confident scaling.
Ensuring 100% application availability through platforms architected for failure resilience.
Eliminating silos with real-time correlation between attack surface and active threats for rapid, accurate mitigation

More like this

‘123456’ Crackable in seconds, 2023’s Most Prevalent Password

For half a decade, NordPass has delved into the realm of password habits, uncovering...

StegCracker – Brute-force Utility to Uncover Hidden Data Inside Files

Steganography is the art of hiding messages covertly so that the sender and recipient...

USBStealer – Password Hacking Tool For Windows Applications to Perform Windows Penetration Testing

USBStealer is a Windows Based Password Hacker Tool that helps to Extract passwords from...