In the process of attempting to secure my local LAN, I have determined that I am at little risk of a dictionary brute-force attack.

This being said, a standard brute-force attack which involves cycling through every possible password in existence is (although not exactly subtle) a very dangerous threat.

I have downloaded THC-Hydra, however I can't find any tutorial or how-to website which actually explains how to use any other function aside from the dictionary attack method, which is really limited to easy passwords:

How do I launch a standard (non dictionary) brute force attack on FTP with THC-Hydra?

  • A long and randomly chosen password is a perfect defence against a brute-force attack. Suppose the attacker can try a billion possible passwords per second. If your password has 16 characters and uses a set of 90 possible characters (upper and lower case letters, digits and punctuation) then it will on average take the attacker 294 trillion years to brute-force their way in. Use good passwords, and then don't worry about brute-force attacks.
    – Mike Scott
    Commented Sep 5, 2015 at 10:20

1 Answer 1


If you want to perform a brute force attack without a dictionary use "-x MIN:MAX:CHARSET", i.e "-x 3:3:a"

The -x switch defines the character set that will be used, instead of the -p switch which would have pointed at the dictionary.

-P "try password PASS, or load several passwords from FILE"

To launch the attack on a FTP server just place ftp in the protocol section of the URL, followed by the target IP address.

For example;

root@find:~/Desktop# hydra -t 10 -V -f -l root -x 4:6:a

-t "run TASKS number of connects in parallel (per host, default: 16)"

-V "verbose mode / show login+pass for each attempt / debug mode"

-f "exit when a login/pass pair is found"

-l "LOGIN or -L FILE login with LOGIN name, or load several logins from FILE"

-x "MIN:MAX:CHARSET password bruteforce generation"

Good blog post about this.

Another link that may help is Hydras page from tools.kali.org, which has a lot of good information including full syntax, beyond the examples above.

Hope this helps.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .