I'm doing a CTF on vulnhub and I need to brute force SSH. I've got 6 usernames and 15.000.000 passwords to try so I'm brute-forcing with hydra by running

hydra -L users.txt -P $LIST/rockyou.txt -t 64 -o hydra_bruteforce.txt ssh://grotesque2

but it's taking a lot. It did 623 tries in 1 minute.

Moreover the target is in the local network, so I'm looking for a faster way to brute force SSH or the brute force will take like a month.

Does anyone know a faster way to brute force SSH?

2 Answers 2


It depends on the server configuration. By default some servers support between 4-10 active connections. So you cannot exceed that number.

Also, it is important to consider that normally Machines from Vulnhub have other attack vectors and bruteforcing SSH it not a very common one.

I would suggest you to check all open ports, enumerate possible vulnerabilities in all ports and then exploit them to gain initial access.

Normally SSH is used in VulnHub machines when you retrieve a custom wordlist from other service in the same machine or you got an SSH key that was not protected properly.

  • Additional, the password for the user is most likely not in a generic password list like rockyou.txt, as someone can assume that the creators of the machine most likely don't want anybody to simply bruteforce the ssh login with a generic wordlist.
    – Mime
    Jun 22, 2022 at 11:01

Rockyou is very large and the sheer volume of it is such that a brute force attack is bound to take a lot of time anywway.

So I would start with smaller (and obviously less complete) lists. Try the most common (worst) passwords first. Who knows, you might get lucky. Don't waste your time trying millions of combinations that have an extremely low likelihood of being used on the target system.

If your attempts fail, then try bigger lists and Rockyou as a last resort.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .