THC Hydra
Hydra is a parallelised network login tester that tries credential lists against services such as SSH, FTP and HTTP forms.
Legal & ethical use. Online guessing against real systems violates computer-misuse laws and service terms. Use this tool only on systems, networks and data that you own or have explicit written permission to test. Unauthorised access or scanning can break computer-misuse laws (for example Pakistan's Prevention of Electronic Crimes Act, 2016, and equivalents elsewhere). Practise in your own lab or in authorised environments such as CTFs.
What it is used for
- Test whether your own lab service lets weak or default passwords in
- Show why account lockout and rate limiting matter
Key features
- Many protocols
- Parallel connections
- Flexible user/password lists
Installation
Install from your distribution (`sudo apt install hydra`) or build from source.
Beginner usage guide
Test only a lab service with throw-away accounts and keep the thread count low to avoid disrupting it.
Example commands
Run these only against your own lab or authorised targets. Placeholder addresses such as 192.0.2.x are documentation ranges.
Test an SSH lab account
hydra -l labuser -P passwords.txt ssh://192.0.2.30-l is a single user, -P a password list and the last argument the target service. Use only on your lab.
References
Source verification
Last reviewed: 2026-10-27
Links checked over HTTP: 2026-10-27 07:51 UTC — official: 200, docs: 200, repo: 200
Command flags checked against the real binary hydra (Hydra v9.7 (c) 2023 by van Hauser/THC & David Maciejak - Ple...) on 2026-10-27.