# How to Use SecLists with Hydra for Password Spraying: A Complete Guide

> Master password spraying with SecLists and Hydra. Learn to clone SecLists and configure Hydra for efficient brute-force attacks. Our guide shows you how to target credentials effectively.

- Repository: [Daniel Miessler 🛡️/SecLists](https://github.com/danielmiessler/SecLists)
- Tags: tutorial
- Published: 2026-03-03

---

**Clone the SecLists repository and invoke Hydra with `-L` pointing to [`Usernames/top-usernames-shortlist.txt`](https://github.com/danielmiessler/SecLists/blob/main/Usernames/top-usernames-shortlist.txt) and `-P` pointing to [`Passwords/openwall.net-all.txt`](https://github.com/danielmiessler/SecLists/blob/main/Passwords/openwall.net-all.txt), using `-t 4` to limit concurrency and `-f` to exit immediately upon finding a valid credential.**

SecLists is the security industry’s standard collection of wordlists, and pairing it with Hydra creates an efficient password spraying workflow. Unlike traditional brute-force attacks that hammer a single account with thousands of passwords, **password spraying** flips the model by trying a small set of common passwords across many usernames to evade account lockout policies. This guide demonstrates how to use SecLists with Hydra for password spraying against SSH, HTTP forms, and RDP services using the repository’s curated wordlists at `danielmiessler/SecLists`.

## Understanding Password Spraying with SecLists

Password spraying prioritizes breadth over depth. Instead of exhausting every password against `root`, you test one password against `root`, `admin`, `guest`, and other high-value accounts before moving to the next password. SecLists supports this methodology by organizing assets by purpose in the repository root.

**Key directories in the source code:**

- **`Usernames/`** – Collections of common login names. The file [`Usernames/top-usernames-shortlist.txt`](https://github.com/danielmiessler/SecLists/blob/main/Usernames/top-usernames-shortlist.txt) contains the ten most frequently targeted accounts, including `root`, `admin`, `test`, and `guest`.
- **`Passwords/`** – Extensive password dictionaries. For spraying campaigns, [`Passwords/openwall.net-all.txt`](https://github.com/danielmiessler/SecLists/blob/main/Passwords/openwall.net-all.txt) provides millions of common passwords compiled from public breaches, offering high hit rates against weak credentials without requiring massive computational time.

## Hydra Command Structure for SecLists

Hydra reads SecLists files directly through two critical flags. The tool iterates through each username in the list and attempts every password, respecting concurrency limits to avoid triggering defensive controls.

**Essential Hydra flags when using SecLists:**

- **`-L`** – Path to the username list (e.g., [`Usernames/top-usernames-shortlist.txt`](https://github.com/danielmiessler/SecLists/blob/main/Usernames/top-usernames-shortlist.txt)).
- **`-P`** – Path to the password list (e.g., [`Passwords/openwall.net-all.txt`](https://github.com/danielmiessler/SecLists/blob/main/Passwords/openwall.net-all.txt)).
- **`-t`** – Number of parallel tasks. Set this to `4` or lower during spraying to reduce noise and avoid lockouts.
- **`-f`** – Stop execution immediately after the first successful login is discovered.

## Step-by-Step Password Spraying Examples

### SSH Services

Target a Linux host by spraying the top usernames against common passwords via SSH. The `-t 4` flag keeps the connection rate modest to evade intrusion detection systems.

```bash

# Clone SecLists locally

git clone https://github.com/danielmiessler/SecLists.git
cd SecLists

# Spray SSH on 192.0.2.45

hydra -L Usernames/top-usernames-shortlist.txt \
      -P Passwords/openwall.net-all.txt \
      -t 4 -f ssh://192.0.2.45

```

### Web Login Forms

For HTTP-based authentication, use the `http-post-form` module. Specify the URL, post parameters using `^USER^` and `^PASS^` placeholders, and a failure string that appears only when credentials are invalid.

```bash
hydra -L Usernames/top-usernames-shortlist.txt \
      -P Passwords/openwall.net-all.txt \
      -t 4 -f \
      http-post-form "https://target.com/login:username=^USER^&password=^PASS^:Invalid login"

```

### RDP and Truncated Lists

When testing Windows Remote Desktop or performing quick validation runs, truncate a large SecLists file to the first 1,000 entries using `head`, then reference the trimmed file with `-P`. Reduce threads to `-t 2` for RDP to accommodate Windows’ authentication handling.

```bash

# Create a mini password list for rapid testing

head -n 1000 Passwords/openwall.net-all.txt > passwords-mini.txt

# Spray against RDP

hydra -L Usernames/top-usernames-shortlist.txt \
      -P passwords-mini.txt \
      -t 2 -f rdp://10.10.10.5

```

## Optimizing Spray Campaigns for Stealth

Successful password spraying requires tuning both the wordlist scope and Hydra’s execution parameters. Because SecLists is version-controlled, you can reference specific commits or tags to guarantee reproducibility across team members.

**Best practices according to the repository structure:**

1. **Start small** – Begin with [`top-usernames-shortlist.txt`](https://github.com/danielmiessler/SecLists/blob/main/top-usernames-shortlist.txt) rather than massive username dumps to minimize authentication events.
2. **Limit concurrency** – Never exceed `-t 10` in production environments; `-t 4` is the recommended default for stealth.
3. **Slice passwords** – Use `head` or `tail` on [`Passwords/openwall.net-all.txt`](https://github.com/danielmiessler/SecLists/blob/main/Passwords/openwall.net-all.txt) to create targeted subsets (e.g., only the top 100 passwords) before launching the full campaign.
4. **Validate targets** – Ensure you have explicit authorization before pointing Hydra at any system, as even low-concurrency sprays generate logged authentication events.

## Summary

- **Clone** the `danielmiessler/SecLists` repository to access curated wordlists.
- **Reference** [`Usernames/top-usernames-shortlist.txt`](https://github.com/danielmiessler/SecLists/blob/main/Usernames/top-usernames-shortlist.txt) via Hydra’s `-L` flag for high-value account targeting.
- **Load** [`Passwords/openwall.net-all.txt`](https://github.com/danielmiessler/SecLists/blob/main/Passwords/openwall.net-all.txt) via the `-P` flag to supply the password corpus.
- **Throttle** parallelism with `-t 4` (or lower) to evade account lockout thresholds.
- **Stop efficiently** by including `-f` to halt the scan immediately upon credential discovery.

## Frequently Asked Questions

### Can I use SecLists with Hydra without cloning the entire repository?

Yes. You can download individual raw files directly from GitHub using `wget` or `curl`. For example, fetch only the top usernames list with `wget https://raw.githubusercontent.com/danielmiessler/SecLists/master/Usernames/top-usernames-shortlist.txt`, then reference the local file with Hydra’s `-L` flag.

### How do I prevent account lockouts when spraying passwords?

Keep Hydra’s task count low using `-t 4` or `-t 2`, and avoid rapid re-spraying the same account within short time windows. Additionally, start with the smallest viable subset of [`Passwords/openwall.net-all.txt`](https://github.com/danielmiessler/SecLists/blob/main/Passwords/openwall.net-all.txt) (e.g., the first 100 entries) to limit authentication attempts per username.

### Which SecLists file should I use for quick penetration tests?

Use [`Usernames/top-usernames-shortlist.txt`](https://github.com/danielmiessler/SecLists/blob/main/Usernames/top-usernames-shortlist.txt) combined with a truncated version of [`Passwords/openwall.net-all.txt`](https://github.com/danielmiessler/SecLists/blob/main/Passwords/openwall.net-all.txt). Run `head -n 1000 Passwords/openwall.net-all.txt > mini.txt` to create a lightweight list that completes in minutes while still covering the most statistically likely weak credentials.

### Does Hydra support protocols beyond SSH and HTTP for spraying?

Yes. Hydra’s modular architecture supports dozens of protocols including RDP, FTP, SMB, Telnet, and database connections like MySQL and PostgreSQL. Simply replace `ssh://` or `http-post-form` in the command with the appropriate service identifier (e.g., `rdp://`, `ftp://`) and ensure the target service is accessible before launching the spray.