What is Hydra?
Hydra is a very well-known and respected network log on cracker (password cracking tool) which can support many different services. (Similar projects and tools include medusa and John The Ripper).
As a password/ log on cracker (hacking tool) – Hydra has been tested on the following protocols:
How does Hydra work?
Hydra is a brute force password cracking tool. In information security (IT security), password cracking is the methodology of guessing passwords from databases that have been stored in or are in transit within a computer system or network. A common approach, and the approach used by Hydra and many other similar pentesting tools and programs is referred to as Brute Force. We could easily do a Concise Bytes on ‘Brute Force Hacking’ but since this post is all about Hydra let’s place the brute-force attack concept within this password-guessing tool.
Brute force just means that the program launches a relentless barrage of passwords at a log in to guess the password. As we know, the majority of users have weak passwords and all too often they are easily guessed. A little bit of social engineering and the chances of finding the correct password for a user are multiplied. Most people (especially those non-IT savvy, will base their ‘secret’ passwords on words and nouns that they will not easily forget. These words are commonly: loved ones, children’s names, street addresses, favorite football team, place of birth etc. All of this is easily obtained through social media so as soon as the hacker has compiled this data it can be compiled within a ‘password list’.
Brute force will take the list that the hacker built and will likely combine it with other known (easy passwords, such as ‘password1, password2’ etc) and begin the attack. Depending on the processing speed of the hackers (auditors) computer, Internet connection (and perhaps proxies) the brute force methodology will systematically go through each password until the correct one is discovered.
It is not considered as being very subtle – but hey it works!
Hydra is considered as being one of the better ones out there and it certainly worth your time as a security professional or student to give it a try.
Resources and tutorials
The majority of pentesting/ hacking tools are created and developed from a security perspective, meaning that they are designed to aid the pentester find flaws in their clients systems and take appropriate action. Hydra works by helping the auditor find weak passwords in their clients network. According to the Hydra developers they recommend that the professional do the following when using Hydra:
The below commands will install Hydra and here is our
favorite video tutorial on how to use Hydra.
How do we defend against Hydra and brute force attacks?
There are several ways a system admin or network engineer can defend against brute force attacks. Here are a few methods. If you can think of any others, or disagree with the below, let us know in the comment below!
What are your thoughts? Have you used Hydra in any white/ back box pentesting and did it work or fail? Can you think of any particular uses with this program or are there alternatives that we should also share with your community?