How to Use Hydra: Practical Password Attack Guide

In one line

Hydra rapidly tries lots of username and password combinations against a login until one works, so you can test how weak or well-protected a login really is.

What this is, for a beginner

Hydra is a fast online password-attack tool. Given a target service, a username or list of usernames, and a wordlist of passwords, it tries the combinations rapidly and reports any that succeed. It supports many protocols, from web login forms to SSH, FTP, and databases, which makes it a go-to for testing whether a login resists automated guessing.

The two things you must get right are the target definition (which service and how it signals success or failure) and the wordlists. For web forms, Hydra needs to know the request format and the string that indicates a failed login, so it can tell a wrong guess from a right one. This guide practises on a login you own.

The legal lab we use: Your own lab (DVWA and a local service)

Run Hydra only against logins and services you own or are authorized to test, such as your local DVWA or a service on your own machine.

Your own lab (DVWA and a local service) project page →

Full walkthrough: exploiting it step by step

Step 1 — Understand the login request

For the DVWA brute-force page, capture the login request and note the parameters and the failure message shown on a wrong password. Hydra needs both.

observed request and failure string

GET /vulnerabilities/brute/?username=admin&password=wrong&Login=Login
→ failure text: "Username and/or password incorrect."

Expected result: You know the request format, the parameter names, and the exact text that indicates failure.

Step 2 — Build the Hydra command for a web form

Use the http-get-form module, supplying the path, the parameter template with ^USER^ and ^PASS^ placeholders, and the failure string so Hydra recognises a wrong guess. Include the session cookie if the page needs one.

terminal

hydra -l admin -P rockyou.txt localhost http-get-form "/vulnerabilities/brute/:username=^USER^&password=^PASS^&Login=Login:Username and/or password incorrect"

Expected result: Hydra begins trying passwords for admin against your local DVWA login.

Step 3 — Read the result

When a guess does not return the failure string, Hydra reports it as a valid credential and stops (or continues, depending on options).

Hydra output

[80][http-get-form] host: localhost   login: admin   password: password

Expected result: Hydra prints the working username and password it discovered, proving the login had no protection against guessing.

Step 4 — Attack a service instead of a form

Hydra also targets protocols directly. Against a service on your own machine, such as a local SSH server you set up for practice, the syntax is simpler because the protocol defines success.

terminal

hydra -l youruser -P rockyou.txt ssh://127.0.0.1

Expected result: Hydra attempts the wordlist against your own SSH service and reports any valid password.

Step 5 — Observe the defences

Raise DVWA to Medium or High, or add a delay to your service, and watch Hydra slow or fail. This is the point: rate limiting, lockouts, and multi-factor authentication defeat online brute forcing.

Expected result: The attack becomes impractically slow or is blocked, demonstrating why these defences matter.

Free resource

Get the free 35-week ethical hacking roadmap

The exact order I'd learn this in, every vulnerability and tool, week by week, with the labs to practise each one. Enter your email and I'll send it over, plus one practical lesson each week.

How to detect and fix this

How to detect it

For defenders, a flood of failed logins from one source is the signature of online brute forcing; alerting on failed-login spikes catches it quickly.
Lockouts and rate limiting both slow the attack and generate clear signals to monitor.
Successful logins following many failures deserve investigation as possible compromise.

How to fix it

Enforce rate limiting, progressive delays, or account lockout on authentication so automated guessing becomes impractical.
Require strong passwords and check them against breached-password lists so common guesses fail.
Enable multi-factor authentication so a guessed password alone cannot grant access.
Monitor and alert on failed-login patterns to detect attacks in progress.

Common beginner mistakes

Getting the failure string wrong, so Hydra cannot distinguish success from failure and reports nonsense.
Using a huge wordlist against a slow or protected login and waiting forever; start small and targeted.
Forgetting the session cookie on web forms that require one, so every attempt fails.
Pointing Hydra at logins or services you do not own, which is illegal; keep it to your own lab.

FAQ

What is the difference between online and offline password attacks?

Online attacks like Hydra guess against a live login and are limited by network speed and defences such as rate limiting. Offline attacks like John the Ripper crack stolen password hashes locally at far higher speed. They apply in different situations: Hydra when you can only try the login, John when you already have the hashes.

Why does my Hydra attack report every attempt as valid?

Almost always the failure string is wrong. Hydra decides success by the absence of the failure indicator, so if that string does not exactly match what the app returns on a wrong password, it misreads every attempt. Capture the exact failure text and try again.

Does multi-factor authentication stop Hydra?

Yes, effectively. Even if Hydra guesses the correct password, multi-factor authentication requires a second factor it does not have, so the login still fails. Combined with rate limiting, it makes online brute forcing impractical.

Where to go from here

You just exploited one vulnerability in a lab. Here's the structured path.

Scattered tutorials teach you tricks; they don't make you a pentester. My mentorship is 35 weeks of exactly this, every vulnerability and tool in a deliberate order, on real labs, with one-on-one feedback on your work so your mistakes get caught early instead of becoming habits.

See the mentorship

Keep practising

How to Exploit Broken Authentication How to Use John the Ripper How to Use Wireshark