THC-Hydra
A very fast network logon cracker which support many different services
hydra-5.4-src.tar.gz
Last update 2006-05-05
[0x00] News and Changelog
PLEASE NOTE: I have currently not much time for coding, however some
modules need to be rewritten. If you have time and experience to help
this community project, please contact me at vh (at) thc (dot) org.
CHANGELOG for 5.4:
###########
* Fixes to the http modules as some Apache installations are picky
* The MySQL module also works with mysqld-5.0, updated
* Added AS/400 return code checks to pop3 module
* Fixed memory leaks in the http-form module.
* Implemented a proposal by Jean-Baptiste.BEAUFRETON (at) turbomeca.fr to
check for "530 user unknown" message in the ftp module
* Added a performance patch by alejandro.mendiondo (at) baicom.com. This one
needs stability testing!
* Beautification to remove compiler warnings of modern gcc
Have fun!
[0x01] Introduction
Welcome to the mini website of the THC Hydra project.
Number one of the biggest security holes are passwords, as every password security study shows.
Hydra is a parallized login cracker which supports numerous protocols to attack. New modules
are easy to add, beside that, it is flexible and very fast.
Currently this tool supports:
TELNET, FTP, HTTP, HTTPS, HTTP-PROXY, SMB, SMBNT, MS-SQL, MYSQL, REXEC,
RSH, RLOGIN, CVS, SNMP, SMTP-AUTH, SOCKS5, VNC, POP3, IMAP, NNTP, PCNFS,
ICQ, SAP/R3, LDAP2, LDAP3, Postgres, Teamspeak, Cisco auth, Cisco enable,
LDAP2, Cisco AAA (incorporated in telnet module).
This tool is a proof of concept code, to give researchers and security
consultants the possiblity to show how easy it would be to gain unauthorized
access from remote to a system.
[0x02] Disclaimer
1. This tool is for legal purposes only!
2. If this tool is used as part of a commercial service (e.g. pentest),
name, version and web address of this tool must be mentioned in the report.
3. If this tool is incorporated into a commercial tool (means: it costs
money, has license costs or upgrade fees, etc.) or called by it,
the name, version and web address of this tool must be mentioned in the
report output of the tool. Addtionally, a commercial version, key file,
etc. must be made available to the author free of charge.
4. Beside 1. to 3. above, the GPL 2.0 applies.
[0x03] Documentation
Hydra comes with a rather long README file that describes the
details about the usage and special options.
[0x04] Development & Contributions
Your contributions are more than welcomed!
If you find bugs, coded enhancements or wrote a new attack module for a service,
please send them to vh (at) thc (dot) org
Interesting attack modules would be:
Oracle SQL*Net, PC-Anywhere, SSHv1, BGPv4, HTTP-NTLM, PPTP, ...
(or anything else you might be able to do (and is not there yet))
[0x05] Screenshots
(1) Target selection
(2) Login/Password setup
(3) Hydra start and output
[0x06] The Art of Downloading: Source and Binaries
For your pleasure, Hydra comes as source and binary release.
1. The source code of Hydra: hydra-5.4-src.tar.gz
(compiles on all UNIX based platforms - even MacOS X, Cygwin on Windows, ARM-Linux, etc.)
2. The Win32/Cywin binary release: hydra-5.4-win.zip
(everything you need to run hydra on win32 platforms is in this zip file)
4. The ARM binary release: hydra-5.0-arm.tar.gz (soon updated)
(created by tick (at) thc (dot) org - everything except SAP R/3 is supported,
runs on all Handhelds with ARM processors running Linux, e.g. iPaq, Zaurus, etc.)
3. The Palm binary release: hydra-4.6-palm.zip
(created by snakebyte (at) gmx (dot) de - does not support all attack modules yet)
[NOTE: the Palm release has got a different source tree. Therefore not all]
[ modules are supported, and updates are not very often. ]
Comments and suggestions are welcome.
Yours sincerly,
van Hauser
The Hackers Choice
http://www.thc.org
