Hydra

Hydra is a very fast network logon cracker that supports numerous protocols including Cisco AAA, FTP, HTTP(S), SSH, SMB, SMTP, SNMP, Telnet, VNC and many others. This tool makes it possible for researchers and security consultants to show how easy it would be to gain unauthorized access to a system remotely. New modules are easy to add, making it highly extensible.

Use cases include testing network service logins for weak credentials, demonstrating brute-force vulnerabilities, and auditing password strength across multiple protocols. It operates by attempting login/password combinations in parallel across specified targets and services.

The package also includes companion tools like dpl4hydra for generating default password lists, pw-inspector for filtering password lists, and hydra-wizard for simplifying command-line usage.

Hydra performs parallelized brute-force attacks by generating or loading login/password combinations and attempting them against specified services on target servers. It supports single logins (-l), password lists (-P), login lists (-L), or combo files (-C), with configurable threads (-t), timing (-w, -W, -c), and service-specific options. Protocols are modular, handling authentication mechanisms like plain text, SSL/TLS, digest-md5, and more, with output to files or restore sessions (-R). Proxy support via environment variables enhances stealth.