# How to Use SecLists with Hydra: A Complete Guide to Brute-Force Testing > Learn to use SecLists with Hydra for effective brute-force testing. Target network services with username and password lists for parallelized login attempts. - Repository: [Daniel Miessler 🛡️/SecLists](https://github.com/danielmiessler/SecLists) - Tags: how-to-guide - Published: 2026-03-03 --- **Use Hydra's `-L` flag to specify username lists and the `-P` flag to specify password lists from the danielmiessler/SecLists repository, then target specific network services like SSH, FTP, or HTTP with parallelized login attempts.** SecLists is a curated collection of wordlists maintained by Daniel Miessler that contains millions of passwords, usernames, and payloads organized by attack type. When paired with Hydra (thc-hydra), a fast parallelized login cracker, these lists become powerful tools for authorized penetration testing and security assessments. ## Understanding the SecLists Directory Structure The danielmiessler/SecLists repository organizes wordlists into logical categories that map directly to Hydra use cases. Knowing where specific files live ensures you select the right list for your target service. For username enumeration, the repository provides options ranging from quick tests to comprehensive spraying campaigns: - **[`Usernames/top-usernames-shortlist.txt`](https://github.com/danielmiessler/SecLists/blob/main/Usernames/top-usernames-shortlist.txt)** — A concise list of the most common usernames (root, admin, test, etc.) ideal for rapid initial testing - **[`Usernames/xato-net-10-million-usernames.txt`](https://github.com/danielmiessler/SecLists/blob/main/Usernames/xato-net-10-million-usernames.txt)** — A massive collection for large-scale credential spraying operations For password attacks, SecLists offers both generic and targeted collections: - **[`Passwords/openwall.net-all.txt`](https://github.com/danielmiessler/SecLists/blob/main/Passwords/openwall.net-all.txt)** — A robust general-purpose password list containing over one million entries derived from leaked databases - **[`Passwords/Default-Credentials/README.md`](https://github.com/danielmiessler/SecLists/blob/main/Passwords/Default-Credentials/README.md)** — An index pointing to device-specific default passwords for routers, IoT devices, and enterprise equipment - **[`Discovery/Web-Content/web-extensions.txt`](https://github.com/danielmiessler/SecLists/blob/main/Discovery/Web-Content/web-extensions.txt)** — Useful for HTTP authentication attacks where you need to identify valid endpoints or parameter names ## Essential Hydra Flags for Wordlist Integration Hydra consumes SecLists through specific command-line flags that define the attack parameters: - **`-L `** — Loads a file containing usernames (one per line). Point this to `SecLists/Usernames/` files. - **`-P `** — Loads a file containing passwords (one per line). Point this to `SecLists/Passwords/` files. - **`-t `** — Sets the number of parallel connections. Increase for speed on robust networks, decrease if targeting rate-limited services. - **`-w `** — Defines the connection timeout in seconds. - **`-s `** — Specifies a non-standard service port. - **`-e ns`** — Enables additional checks: `n` tries null passwords, `s` tries the username as the password. ## Practical Examples for Common Services ### SSH Brute Force on Default Port 22 This command uses a short username list with a comprehensive password list against standard SSH: ```bash hydra -L /opt/SecLists/Usernames/top-usernames-shortlist.txt \ -P /opt/SecLists/Passwords/openwall.net-all.txt \ -t 64 -w 10 \ ssh://target.example.com ``` The `-t 64` flag creates 64 parallel threads, maximizing throughput on stable networks. Reduce this value if the target exhibits throttling behavior. ### FTP with Custom Port Configuration When targeting FTP services running on non-standard ports, use the `-s` flag: ```bash hydra -L /opt/SecLists/Usernames/top-usernames-shortlist.txt \ -P /opt/SecLists/Passwords/openwall.net-all.txt \ -s 2121 -t 32 -w 5 \ ftp://target.example.com ``` This example targets port 2121 instead of the default 21, using 32 threads and a 5-second timeout. ### HTTP Form-Based Authentication For web login forms, Hydra requires the form field names and failure identifiers. Assuming a POST to [`login.php`](https://github.com/danielmiessler/SecLists/blob/main/login.php) with fields `username` and `password`: ```bash hydra -L /opt/SecLists/Usernames/top-usernames-shortlist.txt \ -P /opt/SecLists/Passwords/openwall.net-all.txt \ -t 50 -w 10 -f -V \ https-post-form "https://target.example.com/login.php:username=^USER^&password=^PASS^:F=incorrect" ``` The `^USER^` and `^PASS^` placeholders are mandatory markers that Hydra replaces with entries from your SecLists files. The `F=incorrect` string tells Hydra to treat any response containing "incorrect" as a failed attempt. ### RDP (Remote Desktop Protocol) Attacks Remote Desktop requires slower thread counts due to protocol overhead: ```bash hydra -L /opt/SecLists/Usernames/top-usernames-shortlist.txt \ -P /opt/SecLists/Passwords/openwall.net-all.txt \ -t 16 -w 10 \ rdp://target.example.com ``` Using `-t 16` prevents overwhelming Windows systems that may lock accounts or drop connections under heavy load. ### Credential Spraying with Massive Username Lists When testing a single common password against many usernames (credential spraying), combine the extensive [`xato-net-10-million-usernames.txt`](https://github.com/danielmiessler/SecLists/blob/main/xato-net-10-million-usernames.txt) with the null/same-as-username checks: ```bash hydra -L /opt/SecLists/Usernames/xato-net-10-million-usernames.txt \ -P /opt/SecLists/Passwords/Default-Credentials/default-passwords.txt \ -e ns -t 128 -w 15 \ ssh://target.example.com ``` The `-e ns` flag adds two attempts per username: one with a blank password and one where the password equals the username, often catching misconfigured accounts before the main wordlist iteration begins. ## Selecting Optimal Wordlists for Specific Targets Different attack scenarios demand specific SecLists files: - **Quick validation testing**: [`Usernames/top-usernames-shortlist.txt`](https://github.com/danielmiessler/SecLists/blob/main/Usernames/top-usernames-shortlist.txt) paired with a small password list identifies weak credentials rapidly without excessive network noise. - **Comprehensive password auditing**: [`Passwords/openwall.net-all.txt`](https://github.com/danielmiessler/SecLists/blob/main/Passwords/openwall.net-all.txt) provides broad coverage for general-purpose cracking. - **IoT and embedded devices**: Consult [`Passwords/Default-Credentials/README.md`](https://github.com/danielmiessler/SecLists/blob/main/Passwords/Default-Credentials/README.md) to locate device-specific lists for routers, cameras, and industrial controllers. - **Web application fuzzing**: When brute-forcing HTTP basic auth or discovering valid endpoints, [`Discovery/Web-Content/web-extensions.txt`](https://github.com/danielmiessler/SecLists/blob/main/Discovery/Web-Content/web-extensions.txt) helps identify valid URL patterns. ## Summary - Clone the danielmiessler/SecLists repository to `/opt/SecLists` or your preferred directory to maintain consistent file paths in your commands. - Use `-L` for username files from `SecLists/Usernames/` and `-P` for password files from `SecLists/Passwords/`. - Adjust thread counts (`-t`) based on protocol resilience—higher for SSH (64+), lower for RDP (16). - Leverage `-e ns` to automatically test null passwords and username-as-password combinations before iterating through full wordlists. - Reference `Passwords/Default-Credentials/` when targeting hardware devices that likely retained factory settings. ## Frequently Asked Questions ### Where should I clone SecLists to use with Hydra? Clone the repository to any persistent directory such as `/opt/SecLists` or `~/tools/SecLists`. The path you choose becomes the base reference for all `-L` and `-P` flags. For example: `git clone https://github.com/danielmiessler/SecLists.git /opt/SecLists`. ### Which SecLists file is best for a quick SSH password audit? Use [`Usernames/top-usernames-shortlist.txt`](https://github.com/danielmiessler/SecLists/blob/main/Usernames/top-usernames-shortlist.txt) for usernames and [`Passwords/openwall.net-all.txt`](https://github.com/danielmiessler/SecLists/blob/main/Passwords/openwall.net-all.txt) for passwords. This combination covers the most common credentials without the time investment required for massive lists like [`xato-net-10-million-usernames.txt`](https://github.com/danielmiessler/SecLists/blob/main/xato-net-10-million-usernames.txt). ### How do I prevent Hydra from locking accounts during testing? Reduce the thread count using `-t 4` or `-t 8`, increase the wait time with `-w 30`, and avoid massive username lists unless performing credential spraying with a single password. Always verify account lockout policies before running brute-force attacks. ### Can I use SecLists with Hydra for web services that use tokens or headers? Yes, though you may need protocol-specific modules. For HTTP headers or API tokens, use the `http-get` or `http-post` modules with `^USER^` and `^PASS^` placeholders in the header strings. The `Discovery/Web-Content/` directory contains lists useful for identifying valid API endpoints before attempting authentication.