Hydra: Password Cracking Tool (Summary, Tutorial and Resources)

What is Hydra?
Hydra, now in version 8.1 and last updated December 12th 2014, is a very well-known and respected network log on cracker which can support many different services. (Similar projects and tools include medusa and John The Ripper).

Visit our Hacker Tools Directory for more information on hacking tools – and where we list the best and most commonly used password crackers, IP Scanners, Wireless Hacking Tools and more! Each of the tools contains a video tutorial.

As a password/ log on cracker (hacking tool) – Hydra has been tested on the following protocols:

afp	cisco	cisco-enable	cvs
firebird	ftp	http-get	http-head
http-proxy	https-get	https-head	https-form-get
https-form-post	icq	imap	imap-ntlm
ldap2	ldap3	mssql	mysql
ncp	nntp	oracle-listener	pcanywhere
pcnfs	pop3	pop3-ntlm	postgres
rexec	rlogin	rsh	sapr3
sip	smb	smbnt	smtp-auth
smtp-auth-ntlm	snmp	socks5	ssh2
teamspeak	telnet	vmauthd	vnc

How does Hydra work?
Hydra is a brute force password cracking tool. In information security (IT security), password cracking is the methodology of guessing passwords from databases that have been stored in or are in transit within a computer system or network. A common approach, and the approach used by Hydra and many other similar pentesting tools and programs is referred to as Brute Force. We could easily do a Concise Bytes on ‘Brute Force Hacking’ but since this post is all about Hydra let’s place the brute-force attack concept within this password-guessing tool.

Brute force just means that the program launches a relentless barrage of passwords at a log in to guess the password. As we know, the majority of users have weak passwords and all too often they are easily guessed. A little bit of social engineering and the chances of finding the correct password for a user are multiplied. Most people (especially those non-IT savvy, will base their ‘secret’ passwords on words and nouns that they will not easily forget. These words are commonly: loved ones, children’s names, street addresses, favorite football team, place of birth etc. All of this is easily obtained through social media so as soon as the hacker has compiled this data it can be compiled within a ‘password list’.

Brute force will take the list that the hacker built and will likely combine it with other known (easy passwords, such as ‘password1, password2’ etc) and begin the attack. Depending on the processing speed of the hackers (auditors) computer, Internet connection (and perhaps proxies) the brute force methodology will systematically go through each password until the correct one is discovered.

It is not considered as being very subtle – but hey it works!

Hydra is considered as being one of the better ones out there and it certainly worth your time as a security professional or student to give it a try.

Resources and tutorials
The majority of pentesting/ hacking tools are created and developed from a security perspective, meaning that they are designed to aid the pentester find flaws in their clients systems and take appropriate action. Hydra works by helping the auditor find weak passwords in their clients network. According to the Hydra developers they recommend that the professional do the following when using Hydra:

• Step 1: Make your network as secure as possible.
• Step 2: Set up a test network
• Step 3: Set up a test server
• Step 4: Configure services
• Step 5: Configure the ACL
• Step 6: Choose good passwords
• Step 7: Use SSL
• Step 8: Use Cryptography
• Step 9: Use an IDS
• Step 10: Throw Hydra against the security and try and crack the logon commands.

The below commands will install Hydra and here is our favorite video tutorial on how to use Hydra.

How do we defend against Hydra and brute force attacks?
There are several ways a system admin or network engineer can defend against brute force attacks. Here are a few methods. If you can think of any others, or disagree with the below, let us know in the comment below!

• Disable or block access to accounts when a predetermined number of failed authentication attempts has been reached.
• Consider multi-factor or double opt-in/ log in for users.
• Consider implementing hardware-based security tokens in place of system-level passwords.
• Enforce all employees to use generated passwords or phrases and ensure every employee uses symbols whenever possible.
• And the most simple – remove extremely sensitive data from the network, isolate it!

In Summary
What are your thoughts? Have you used Hydra in any white/ back box pentesting and did it work or fail? Can you think of any particular uses with this program or are there alternatives that we should also share with your community?