THC-Hydra

THC-Hydra is one of the fastest and most reliable tools for testing how well systems resist brute-force and dictionary attacks on their login services. It can also be used to recover a forgotten password to a resource that uses a login and password pair to sign in.

Hydra supports more than 50 different protocols and services out of the box. Its main difference from other tools of this class, besides high speed and parallel testing across several threads, is its modularity: you can add new modules that provide support for further network devices and protocols. New modules can be found on the project page, written by third parties, or written by yourself.

As a source of logins and passwords the program uses wordlists. To improve the chance of a successful match you can also generate candidates by rule, specifying the length and the set of characters they may consist of. The program can test several protocols in parallel, and its actual speed depends on the target service, the network and the number of parallel tasks. It can save and restore a session, so an interrupted run can be continued later, and it ships with helper tools such as pw-inspector for filtering wordlists by password policy.

THC-Hydra offers rapid and reliable testing of system security against brute force attacks, enhancing password recovery and network protocol versatility.

Here is a short list of the protocols and devices that THC-Hydra can work with: HTTP, FTP, SMTP, POP3, IMAP, MySQL, NCP, NNTP, SOCKS, SSH, XMPP, Cisco and MikroTik routers, network cameras, Siemens Simatic S7-300 controllers and many more. Hydra is available for almost all operating systems, including Windows through the Cygwin environment, and it is distributed with open source code, so any programmer can review how a given function is implemented and confirm that there is nothing malicious in the code before a pentest.

THC-Hydra is an excellent tool for researchers and security consultants to demonstrate how easy it can be to gain unauthorised remote access to a system when weak passwords are used.