Hydra: A Comprehensive Guide on Brute Forcing Tool

Running Head: HYDRA 1
HYDRA
Name
Institutional Affiliation

HYDRA 2
Introduction of the tool
A password is simply a character string that should be kept secret, since it’s meant to
provide access, or to authenticate the specific users to a resource. Conventionally, passwords
should be kept in a need to know basis so as to limit the number of persons who can access a
specific resource. Passwords are founded upon unpredictability, length, and complexity. These
three factors area measure of how well the password can withstand an attempt of breaking it or
random guess (Nájera-Gutiérrez, 2018). Having a weak password exposes sensitive information
to access by anyone who might be having the will and time to crack it. Accessed data can then be
sold or used for blackmail where ransom is normally required.
Password strength and weakness, is therefore, determined by the ease that can be
associated with breaking it, and the scheme that is adopted for the purpose. In most cases,
credential related passwords are normally cracked using Brute Force. The technique adopts a
trial an error approach in an effort to decode information that has been encrypted in the
password. Decryption can also be used in the process of gaining access to data, and a hacking
tool is normally necessary for this purpose. In this case, Hydra is known to be one of the most
efficient network login crackers (Sperotto, et al., 2009). The tool is listed among the best due to
its ability to support a wide range of protocols. Hydra is quite flexible and fast, and it also makes
it easy for vulnerability researchers to incorporate new modules so as to simulate networks in a
myriad of ways.
Features of the tool
Hydra is an open source hacking tool. The tool’s main purpose is for helping
vulnerability testing teams, and individuals to authenticate access using brute force remotely
(Zolotukhin, et al., 2014). Hydra is capable of supporting about 50 protocols and performs very
efficiently when evaluating passwords. The tool enables testing of security levels associated with
server related environments. Hydra can be used on various platforms such as Linux, OS X, Free
BsD, Windows, and Solaris. Hydra is also associated with the following primary features:
 Superfast password cracking capabilities.
 Can be used in part with a huge base of operating systems
 It can launch brute force attacks in a parallelized manner, therefore, increasing the
chances of a successful attack.
 It’s a module-based software that makes it possible for security teams to build modules
that have been customized to fit a specific scenario
 Support many protocols such as FTP, HTTPS, IMAP, CVS, MySQL, HTTP-Proxy,
LDAP, IRC and many others.

HYDRA 3
Very many other password login crackers can be used to test passwords like hydra by
none of them matches the protocol based and parallelized capability like hydra.
INSTALLING HYDRA
Hydra normally comes pre-installed on its main platform, which is Kali Linux. As
mentioned earlier, Hydra can be supported on different platforms, and all that is needed is to
compile it, install, then configure it so that various parameters can be matched to the systems
environment variables. The platforms that hydra supports include;
 Any UNIX platform (Solaris, Linux, *bsd, etc)
 Cygwin with Windows (IPv6 and IPv4)
 Mobile based systems that rely on the Linux, QNX, and MacOs platforms (Blackberry
10, Android, Zaurus, iPhone, and iPaq)
 MacOS (any BSD clone)
In order to undertake compilation, configuration, and installation, the following will need to be
typed into the terminal:
git clone https://github.com/vanhauser-thc/thc-hydra.git
cd thc-hydra
./configure
make
make install
Users who have Debian/Ubuntu will need to use dependency libraries. However, if it is hard to
locate the libraries from the repository, they can be downloaded and installed manually.
apt install libssl-dev libssh-dev libidn11-dev libpcre3-dev libgtk2.0-dev libmysqlclient-dev
libpq-dev libsvn-dev firebird-dev libncp-dev
Techniques used by the tool to exploit vulnerabilities of information systems

HYDRA 4
Hydra’s Brute force approach implements unending barrage of passwords on the login
platform in an effort to guess the correct password. It is common for a huge number of
information systems users to have weak passwords. Using some small amount of social
engineering in part with the brute force attack increases the chances of ending up with the right
password (Syed, Syrame, & Bourgeois, 2013). Social engineering involves the hacker colleting
information from social sites then compiling a password list. Brute force takes the implemented
list, and then tries to combine it with other technical passwords so as to come up with the actual
password. Based on the hackers processing speed, internet connectivity, Hydra will evaluate
every possible password until the correct one is put together. The number of proxies used by the
hacker can also be a determinant when using Hydra (Kumar, 2011).
HOW TO USE HYDRA
Hydra has two primary flavors, which are CLI and GUI-gtk versions. Additionally, there
is a CLI based version that is known as hydra wizard (Allen, Heriyanto, & Ali, 2014). This
version guides the user through each step of execution rather than having to type commands
every time.
Web Based Brute force attacks using hydra
There are various Brute Force services that can be supported by Hydra, and the common
one includes web-based Brute Force password access that exploits social sites login form, web-
router login form, and bank login form etc. The form http[s]-{get|post} is tasked with handling
all the requests (Mukhopadhyay, 2009). The following arguments must be used to enable web
logins brute force attacks: Target, Service Module, Password List, Login Username, and Form
Parameters.
Using Iceweasel and Firefox to obtain post parameters
On the browser tab, press: “CTRL + SHIFT + Q”. This opens the url
http://testasp.vulnweb.com/Login.asp?RetURL=%2FDefault%2Easp%3F, and allows files to be
transferred to the repository. All methods are GET in this case since there isn’t POST data. This
has been shown below.