Tools & Commands · Ethical Hacking Tools
Hydra
Password auditing · Advanced
A tool that tries logins against a live service you are authorized to test. Unlike an offline hash audit, it talks to the service itself.
It checks whether an online login will accept weak credentials. Because it touches a live service, the written scope, rate, and target list matter even more than in an offline audit.
Example: A test against a lab login shows that one account still uses a default password. The account is changed and the default is disabled.
Git in the Zone explains security tools and attack terminology so you can recognize them and defend against them. Practice only on systems you own or have written permission to test. Nothing on this site runs a command or an exploit.
What it is for
Attempt logins against a service covered by written authorization.
Authorized use: Do not point login guessing at services you do not own. Git in the Zone does not provide target commands or credential lists.
Operating systems: Primarily Linux, with builds available for other systems.
Language you will see
- online attempt
- account lockout
- protocol module
How to read the options
- Online attempt: Each guess is sent to a real service and may appear in logs or lock the account.
- Lockout risk: A defensive control may freeze the account. An authorized test plans for that before it starts.
Common misconception
- Online guessing can lock accounts and create logs. An offline hash audit does neither. They are different tests.