hydra

No entries match these filters. Clear filters

1. v9.6 Sep 3, 2025 · release notes

   Hydra v9.6 adds SSH legacy cipher support, PostgreSQL custom port, SMBSMBA network file-sharing protocol developed by Microsoft that lets systems share files, printers, and named pipes over a network; cyber tools target or speak it because it is ubiquitous in Windows environments. expired-account handling, and HTTP 403 support.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v9.6 https://github.com/vanhauser-thc/thc-hydra.git
   # already have the repo? check out this version:
   $ git checkout v9.6

   └──▷ TRY IT
   Attack an older SSH server that requires legacy ciphers (e.g., arcfour, diffie-hellman-group1-sha1) that modern clients reject by default.
   copy

   $ hydra -l root -P /usr/share/wordlists/rockyou.txt ssh://<target>

   • Supports SSH legacy ciphers, enabling brute-force against older SSH servers that require deprecated algorithms.
   • Supports custom ports for PostgreSQL targets.
   • Improves SMB module handling of expired-credential responses.
   • Supports HTTP 403 responses, expanding coverage for web form attacks where targets return 403 on failure.

   4 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !freerdp dependency upgraded from v2 to v3; systems without freerdp v3 installed will fail to build or use the RDPRDPA Microsoft protocol that lets a user view and control a remote Windows desktop over a network, giving cyber tools a standard channel to audit, attack-simulate, or monitor Windows systems remotely. module.
2. v9.4 Sep 8, 2022 · release notes

   Adds 2= optional parameter to http-post-form module for handling 302 success codes

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v9.4 https://github.com/vanhauser-thc/thc-hydra.git
   # already have the repo? check out this version:
   $ git checkout v9.4

   └──▷ USE IT
   Force hydra to accept a redirect (302) from an API endpoint instead of logging it as a failed login attempt.
   shell copy

   hydra -l user -P wordlist.txt http-post-form "/login:username=^USER^&password=^PASS^:2=302"

   • http-post-form module now supports the 2= optional parameter to treat HTTP 302 responses as successful credentials.

   1 detail in Everything

3. v9.3 Feb 3, 2022 · release notes

   Adds Cobalt Strike module support and IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. -M address support in Hydra v9.3

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v9.3 https://github.com/vanhauser-thc/thc-hydra.git
   # already have the repo? check out this version:
   $ git checkout v9.3

   └──▷ USE IT
   Target an IPv6 address or range using the -M flag
   shell copy

   hydra -l user -P pass.txt -M [2001:db8::]/64 ssh

   • Adds new cobaltstrike module for credential testing (contributed by ultimaiiii)
   • Enables -M flag to accept IPv6 addresses or ranges
   • Adds make uninstall target for clean removal of installed binaries

   3 details in Everything

4. v9.2 Mar 15, 2021 · release notes

   Adds msys and gcc 10 support plus IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. Host headers; removes deprecated -r flag

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v9.2 https://github.com/vanhauser-thc/thc-hydra.git
   # already have the repo? check out this version:
   $ git checkout v9.2

   • Adds msys support for building and running on MSYS environments
   • Enables gcc 10 support for the xhydra component
   • Adds IPv6 support for Host: header in http based modules

   3 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !The -r flag is removed, breaking invocations that rely on rain mode
5. v9.1 Jul 29, 2020 · release notes

   Adds smb3 module via smb2, http string matching conditions F=/S=, and -K switch to disable redo attempts

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v9.1 https://github.com/vanhauser-thc/thc-hydra.git
   # already have the repo? check out this version:
   $ git checkout v9.1

   └──▷ USE IT
   Disable automatic retry on failed connections to speed up large-scale scans of many hosts.
   shell copy

   hydra -l admin -P passwords.txt -K ssh://192.168.1.1

   Add a new smb3 target to enumerate credentials over the SMBSMBA network file-sharing protocol developed by Microsoft that lets systems share files, printers, and named pipes over a network; cyber tools target or speak it because it is ubiquitous in Windows environments. protocol.
   shell copy

   hydra -l user -P pass.txt -t 16 smb2://10.0.0.5

   Match login success by verifying specific strings in the HTTP response body or status code.
   shell copy

   hydra -l admin -P wordlist.txt http-post-form "/login:user=^USER^&pass=^PASS^:F=Login succeeded:S=302"

   • Adds -K command line switch to disable redo attempts for mass scanning workflows
   • Adds smb2 module supporting SMB3SMB3The third major version of Microsoft's Server Message Block protocol, used for file and printer sharing over a network, adding encryption, multichannel support, and improved performance that cyber tools exploit or inspect. protocol via libsmbclient-dev

   2 details in Everything