TryHackMe Hydra Walkthrough: Brute-Forcing Web and SSH Passwords with Hydra

Introduction

Hydra is one of the most widely used password-cracking tools in penetration testing. It supports numerous protocols and services, allowing security professionals to test the strength of authentication mechanisms through brute-force and dictionary attacks.

In this walkthrough, I will demonstrate how I completed the Hydra room on TryHackMe and used Hydra to identify valid credentials for both a web application and an SSH service.

Objective

The goal of this room was to gain practical experience using Hydra to perform password attacks against different services and understand how authentication mechanisms can be tested in a controlled environment.

Accessing the Target Application

After opening the target IP address in a web browser, a login page was presented.

The presence of a login form indicated that Hydra’s web form modules could be used to automate password testing.

Brute-Forcing the Web Login Form

By examining the login page, it was observed that credentials were submitted to the /login endpoint using an HTTP POST request. To identify the password for the user molly, Hydra's http-post-form module was used together with the RockYou password wordlist.

Command Used

hydra -l molly -P Tools/wordlists/rockyou.txt <TARGET_IP> http-post-form "/login:username=^USER^&password=^PASS^:F=incorrect"

Understanding the Command

• -l molly specifies the username to test.
• -P rockyou.txt provides the password wordlist.
• http-post-form targets a web form that uses HTTP POST requests.
• /login is the authentication endpoint.
• username=^USER^&password=^PASS^ defines the form parameters.
• F=incorrect identifies the text returned when authentication fails.

After running the command, Hydra successfully discovered valid credentials for the target account.

The recovered credentials were then used to authenticate to the web application successfully.

Brute-Forcing the SSH Service

The next task involved identifying valid credentials for the SSH service running on the target machine.

Hydra’s SSH module was used with the same username and password wordlist.

Command Used

hydra -l molly -P Tools/wordlists/rockyou.txt <TARGET_IP> -t 4 ssh

Understanding the Command

• -l molly specifies the target username.
• -P rockyou.txt specifies the password wordlist.
• -t 4 limits Hydra to four concurrent connections.
• ssh specifies the target service.

After several attempts, Hydra successfully identified valid SSH credentials.

Connecting via SSH

Using the recovered credentials, an SSH session was established with the target machine.

ssh molly@<TARGET_IP>

Successful authentication provided access to the system.

Conclusion

The Hydra room provided valuable hands-on experience with password attacks against both web applications and SSH services. Through this exercise, I gained a better understanding of how Hydra operates, how web authentication forms can be targeted, and why strong authentication controls are essential for protecting systems.

Happy Hacking! 🚀

This walkthrough was completed in a legal lab environment provided by TryHackMe for educational purposes only.