THC Hydra

THC-Hydra

A very fast network logon cracker which support many different services
hydra-5.4-src.tar.gz

Last update 2006-05-05

[0x00] News and Changelog

       PLEASE NOTE: I have currently not much time for coding, however some
       modules need to be rewritten. If you have time and experience to help
       this community project, please contact me at vh (at) thc (dot) org.

 CHANGELOG for 5.4:
 ###########
 * Fixes to the http modules as some Apache installations are picky
 * The MySQL module also works with mysqld-5.0, updated
 * Added AS/400 return code checks to pop3 module
 * Fixed memory leaks in the http-form module.
 * Implemented a proposal by Jean-Baptiste.BEAUFRETON (at) turbomeca.fr to
   check for "530 user unknown" message in the ftp module
 * Added a performance patch by alejandro.mendiondo (at) baicom.com. This one
   needs stability testing!
 * Beautification to remove compiler warnings of modern gcc

 Have fun!


[0x01] Introduction

 Welcome to the mini website of the THC Hydra project.

 Number one of the biggest security holes are passwords, as every password security study shows.
 Hydra is a parallized login cracker which supports numerous protocols to attack. New modules
 are easy to add, beside that, it is flexible and very fast.

 Currently this tool supports:
   TELNET, FTP, HTTP, HTTPS, HTTP-PROXY, SMB, SMBNT, MS-SQL, MYSQL, REXEC,
         RSH, RLOGIN, CVS, SNMP, SMTP-AUTH, SOCKS5, VNC, POP3, IMAP, NNTP, PCNFS,
         ICQ, SAP/R3, LDAP2, LDAP3, Postgres, Teamspeak, Cisco auth, Cisco enable,
         LDAP2, Cisco AAA (incorporated in telnet module).

 This tool is a proof of concept code, to give researchers and security
 consultants the possiblity to show how easy it would be to gain unauthorized
 access from remote to a system.

[0x02] Disclaimer

 1. This tool is for legal purposes only!
 2. If this tool is used as part of a commercial service (e.g. pentest),
    name, version and web address of this tool must be mentioned in the report.
 3. If this tool is incorporated into a commercial tool (means: it costs
    money, has license costs or upgrade fees, etc.) or called by it,
    the name, version and web address of this tool must be mentioned in the
    report output of the tool. Addtionally, a commercial version, key file,
    etc. must be made available to the author free of charge.
 4. Beside 1. to 3. above, the GPL 2.0 applies.

[0x03] Documentation

 Hydra comes with a rather long README file that describes the
 details about the usage and special options.

[0x04] Development & Contributions

 Your contributions are more than welcomed!

 If you find bugs, coded enhancements or wrote a new attack module for a service,
 please send them to vh (at) thc (dot) org

 Interesting attack modules would be:
 Oracle SQL*Net, PC-Anywhere, SSHv1, BGPv4, HTTP-NTLM, PPTP, ...
 (or anything else you might be able to do (and is not there yet))

[0x05] Screenshots

 
 (1) Target selection

 
 (2) Login/Password setup

 
 (3) Hydra start and output

[0x06] The Art of Downloading: Source and Binaries

 For your pleasure, Hydra comes as source and binary release.

 1. The source code of Hydra: hydra-5.4-src.tar.gz
    (compiles on all UNIX based platforms - even MacOS X, Cygwin on Windows, ARM-Linux, etc.)

 2. The Win32/Cywin binary release: hydra-5.4-win.zip
    (everything you need to run hydra on win32 platforms is in this zip file)

 4. The ARM binary release: hydra-5.0-arm.tar.gz (soon updated)
    (created by tick (at) thc (dot) org - everything except SAP R/3 is supported,
     runs on all Handhelds with ARM processors running Linux, e.g. iPaq, Zaurus, etc.)

 3. The Palm binary release: hydra-4.6-palm.zip
    (created by snakebyte (at) gmx (dot) de - does not support all attack modules yet)
          [NOTE: the Palm release has got a different source tree. Therefore not all]
          [      modules are supported, and updates are not very often.             ]

Comments and suggestions are welcome.

Yours sincerly,

van Hauser
The Hackers Choice
http://www.thc.org