You have attacked credentials from two directions already. You took captured password hashes and cracked them offline with john/hashcat — full local speed, no network, no defender watching. And you drove Burp Intruder through the proxy to replay and fuzz a single request from a GUI. This lesson fills the last corner: online credential attacks fired straight from the command line at a live login — the job of Hydra (and its cousin Medusa).
Hydra is a fast, parallelised network login cracker shipped in Kali. It speaks dozens of protocols, but for web work the two modules that matter are **http-post-form and http-get-form**: you describe the login request to Hydra, hand it a list of usernames and a list of passwords, and it fires one login attempt per guess until it finds a working pair or runs out of guesses.
Scope warning. An online attack hits the real, production authentication system. Every guess is a genuine login attempt that reaches the server, lands in its logs, can lock out real accounts, and can trip alerting and incident response. This is loud and intrusive by design. Run Hydra only against a target you own — the bundled NovaCart application on loopback, a local DVWA — or one covered by a signed scope or an in-scope bug-bounty asset. Capability is never permission; that is the unchanging rule from the ethics and authorization lesson.
About the practical. You can point Hydra at the NovaCart login on loopback (/rest/user/login). The whole skill is in the module string — the path, the body with the^USER^/^PASS^markers, and the failure condition. If you have no lab to hand, follow the commands closely so you can recognise them; you do not need a successful crack to finish the lesson.
In this lesson you will:
- Place this attack precisely: online (live endpoint, one request per guess) versus offline hash cracking — and the shapes of brute force, credential stuffing, and password spraying.
- Build the **
http-post-formmodule string: path, body with^USER^/^PASS^, and the all-important failure (F=) / success (S=) condition**. - Supply a username list with **
-Land a password list with-P** (or single values with-l/-p), drawing on SecLists and **rockyou.txt**. - Understand why the attack is loud — and why rate limiting, lockout, and MFA are what defeat it.
Estimated time: ten to twelve minutes.
When you are ready, send the Continue signal.