# How to Brute Force Websites & Online Forms Using Hydra

**URL:** <https://onehack.st/t/how-to-brute-force-websites-online-forms-using-hydra/82330>\
**Category:** Tutorials & Methods\
**Tags:** hacking, freebies\
**Created:** [April 26, 2020, 6:09am UTC](https://onehack.st/t/how-to-brute-force-websites-online-forms-using-hydra/82330 "2020-04-26T06:09:57Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![TheStrength](https://onehack.st/user_avatar/onehack.st/thestrength/32/46753_2.png) [@TheStrength](https://onehack.st/u/TheStrength)\
**Post date:** [April 26, 2020, 6:09am UTC](https://onehack.st/t/how-to-brute-force-websites-online-forms-using-hydra/82330/1 "2020-04-26T06:09:57Z")

</div>

While working through NINEVAH on HackTheBack (Write-Up on this coming in a future post), I came across a couple web forms that I needed to break into. In my opinion, using the Intruder feature within BurpSuite is an easier way to run brute-force attacks, but the effectiveness of the tool is greatly reduced when using the free community version. Instead of dealing with slow brute-force attempts, I decided to give Hydra a try.

[![](https://infinitelogins.com/wp-content/uploads/2020/02/image-39.png) ](https://infinitelogins.com/wp-content/uploads/2020/02/image-39.png)  
[![](https://infinitelogins.com/wp-content/uploads/2020/02/image-46.png) ](https://infinitelogins.com/wp-content/uploads/2020/02/image-46.png)

## What we’re breaking into

## Using Hydra to Brute-Force Our First Login Page

Hydra is a fairly straight forward tool to use, but we have to first understand what it needs to work correctly. We’ll need to provide the following in order to break in:

- Login or Wordlist for Usernames
- Password or Wordlist for Passwords
- IP address or Hostname
- HTTP Method (POST/GET)
- Directory/Path to the Login Page
- Request Body for Username/Password
- A Way to Identify Failed Attempts

Let’s start piecing together all the necessary flags before finalizing our command.

Full tutorial link

> **[How to Brute Force Websites & Online Forms Using Hydra](https://infinitelogins.com/2020/02/22/how-to-brute-force-websites-using-hydra/)**
>
> Encrypt and Anonymize Your Internet Connection for as Little as $3/mo with PIA VPN. Learn More While working through NINEVAH on HackTheBack (Write-Up on this coming in a future post), I came across…