TechKnowSurge

VideoSecurityFree

DEMO: Using hydra to Hack an Account

Hydra is a command-line password cracking tool used in ethical hacking to test authentication security through dictionary attacks and password spraying against network services like FTP.

⚑ Complete this video to capture a CTF flag worth 1 point.

About this video

Hydra is a command-line password cracking tool commonly used during penetration testing and ethical hacking assessments to evaluate the strength of authentication controls on networked services. It supports a wide range of protocols, including FTP, SSH, HTTP, and others, making it a versatile utility for security professionals who need to test how well a target system resists unauthorized access attempts. The basic syntax involves specifying a username, a password or password source, a target host, and the protocol being tested, keeping the tool approachable while still offering significant depth. One of Hydra's most practical capabilities is wordlist-based testing, where instead of manually entering individual passwords, a text file containing many candidate passwords is passed directly to the tool. This approach, known as a dictionary attack, allows a large number of password guesses to be processed rapidly against a target service. Hydra also supports supplying a file of usernames in addition to a password list, enabling simultaneous enumeration of both credentials. When a single password is tested across multiple usernames, the technique is referred to as password spraying, a common method attackers use to avoid account lockout thresholds. Understanding how Hydra operates gives security professionals direct insight into how credential-based attacks are executed in practice, which is essential for building effective defenses. Recognizing the difference between brute force, dictionary attacks, and password spraying helps organizations configure appropriate controls, such as account lockout policies, multi-factor authentication, and login attempt monitoring, to reduce exposure to these threats.

What you'll learn

Configure and execute Hydra command-line syntax to perform dictionary-based password attacks against a network service such as FTP
Distinguish between a dictionary attack and password spraying as credential-based attack techniques

What's covered

Hydra Password Cracking

Hydra Basic Command
- Syntax Structure
  - Username flag -l
  - Password flag -p
  - Target host and protocol
- FTP Server Demo
  - Kali Linux environment
  - Single password test fails
Password File Option
- Uppercase -P flag
- wordlist.txt example
  - Found password monkey one
- rocku.txt word list
Username Options
- Lowercase -l single user
- Uppercase -L username file
- Combined -L and -P flags
Attack Types
- Dictionary Attack
  - Tests list of passwords
- Password Spraying
  - Same password many users
  - Covered in future lesson

Key terms

Dictionary Attack: A type of brute force attack that uses a predefined list of common words and phrases to guess passwords.
Password Spraying: An attack that attempts a single commonly used password against many different user accounts before moving to the next password, deliberately staying below account lockout thresholds to avoid detection.
Brute Force Attack: An attack method that systematically tries all possible combinations of passwords or keys until the correct one is found.
File Transfer Protocol: A standard network protocol used to transfer files between a client and a server over a TCP network.
Authentication: The process of verifying the identity of a user, device, or system.

Topics

Hydra Password Cracking Dictionary Attack Password Spraying Ethical Hacking Ftp Cybersecurity

Transcript

We're going to take a look at a password cracking software called Hydra. Just a quick reminder, this is for ethical hacking purposes only.

The basic command

The command that we're going to use is pretty simple. We're going to start out with hydra. Then we're going to type in -l and username, and then -p, the password, the host we're trying to get to or test, and the protocol.

Let's see what that looks like. I'm on a Kali Linux box. I also have a Debian server that's set up with an FTP server. What we're going to do is try to crack a password on the FTP server using Hydra.

So I'm going to type in hydra -l and then we will type in the username. In this case, we are going to test out password crack demo. And then the password there that we're going to try is going to be "test password." And then we'll do the IP address, which is 10.110.40. And then we're testing FTP. So we're going to hit enter on this. It's going to go and test this out, and as we'll see, it's not successful. It says zero valid passwords found. So no success there.

All right, well, we can try something else. We could try -p "test password one." As you can see, this is not only tedious, but it's really no different than logging into the server, testing things on the FTP server.

Using a password file

So this Hydra is more powerful than that. We can actually do more things with it. This is the command we just ran. We used the lowercase l to specify a username and a lowercase p to specify a password, but we could actually specify an uppercase P to have a password file.

So let's see what that looks like. What I'm going to do is do an ls so we can see what files we have in here. I have a password file here called rockyou.txt, or the one we're actually going to use is this word list. Let's take a look inside that word list. I'm just going to do a cat wordlist and we'll hit enter. And there you go, there's the passwords that it's testing, just some variations of these passwords.

So now let's give this a try and test things out. We're going to go back to that command that we had before, but instead of specifying a single password, we're going to do an uppercase P and then we're going to specify that word list, so wordlist.txt. We'll hit enter and see what happens with this one. As you can see, it found the password. The password to the PW crack demo is "monkey one." So now you can see that we could run through that. And if we take a look at the cat rockyou.txt, you can see it's a whole bunch of passwords. So we could just run this Hydra and test out a bunch of different passwords.

Username files and attack types

We could also do the same thing with the username. We could reference a username file — we would use a capital L — or we could do both a username file and a password file with a capital L and a capital P. So as you can see, we have several different combinations that we could run with this.

Essentially, what we're doing, if we're using a word list like we did with just that last demo there, is a type of dictionary attack. We've got a list of passwords and we're testing out that list of passwords. If we are changing the username and using the same password, that's called password spraying. And we'll get more into password spraying in another lesson.

Read the full transcript Show less

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →