I'm learning Active Directory attacks and in one of the labs we are given the example of gaining the initial foothold in an AD system via NetNTLM by performing a password spraying attack. For the purpose of the lab we are given a custom python script which performs the attack but told we could also use Hydra. The login form we are attacking is not an actual HTML form but rather one of those popups (not sure what it's called so here is a screenshot):

enter image description here

Using ZAP I have gathered that this uses a GET request in the following format (this is an example of an invalid login which returns a 401 response):

GET http://ntlmauth.za.tryhackme.com/ HTTP/1.1
host: ntlmauth.za.tryhackme.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/115.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1

I have used Hydra many times before to attack mainly POST requests. I am trying to figure out how to leverage Hydra to attack this GET request. It appears there is some sort of encoding taking place but I can't figure out what it is.

1 Answer 1


The syntax you're looking for from your example is:

hydra -L <username_list> -p <pwd_to_spray> <host> http-get '/:A=NTLM:F=401'

If you use the -U on a module (http-get), you'll see what options are available:

% hydra -U http-get
Hydra v9.5 (c) 2023 by van Hauser/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway).
Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2023-12-14 08:38:00 Help for module http-get:
======================================================================= Module http-get requires the page to authenticate.
The following parameters are optional:
(a|A)=auth-type specify authentication mechanism to use: BASIC, NTLM or MD5
(h|H)=My-Hdr: foo to send a user defined HTTP header with each request
(F|S)=check for text in the HTTP reply. S= means if this text is found, a valid account has been found, F= means if this string is present the combination is invalid. Note: this must be the last option supplied.
For example: "/secret" or "http://bla.com/foo/bar:H=Cookie: sessid=aaaa" or "https://test.com:8080/members:A=NTLM"

  • I didn't know about the :A flag. So in this case hydra will negotiate the NTLM handshake process and input the relevant username and password in each time? I'm just trying to understand how it works under the hood (and I'm not talented enough at reading code to look through it and understand). Dec 15, 2023 at 1:22

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .