---
name: "hydra-login-bruteforce-audit"
description: "Audit authentication strength and rate limiting across network services with THC Hydra."
metadata:
  author: "vanhauser-thc"
  version: "1.0.0"
  runtime_compatibility:
    - "codex"
    - "claude-code"
    - "cursor"
    - "windsurf"
triggers:
  - "audit login strength hydra"
  - "test rate limiting hydra"
  - "run hydra ssh audit"
permissions:
  fs_read: true
  fs_write: "workspace"
  shell_exec: false
  net_access: false
---

# Hydra Network Login & Authentication Auditing

Tests network service credential resilience with Hydra: parallel dictionary attacks on SSH, FTP, HTTP POST form logins, verifying account lockout policies, and rate-limit defenses.

## When to Invoke
Invoke this skill whenever you need to:
- audit login strength hydra
- test rate limiting hydra
- run hydra ssh audit

## Execution SOP & Rules
1. Execute testing exclusively on authorized corporate test systems.
2. Specify dictionary wordlists with -L users.txt and -P passwords.txt.
3. Tune parallelism with -t 4 to prevent overwhelming network interfaces.
4. Verify that the target service triggers rate limiting or IP banning within expected thresholds.

## Verification Checklist
- Run local linting, syntax validation, and type-checks before reporting completion.
- Ensure all created or modified files adhere to workspace boundaries and avoid uncommitted secrets.
- Verify tests or build commands exit cleanly with return code 0.