This project demonstrates how brute-force attacks can be simulated using the Hydra tool against services like SSH. It highlights system vulnerabilities, shows the speed and efficiency of such attacks, and evaluates real-world mitigation strategies to secure systems.

• Overview
• Features
• System Requirements
• Architecture
• Installation & Setup
• Execution
• Results
• Defense Strategies
• Monitoring
• References

This simulation uses THC-Hydra, a fast and powerful login cracker, to perform SSH brute-force attacks against a virtual environment. The project measures attack success rates, duration, and impact on various system configurations (no lockout, moderate, and aggressive lockout policies).

• SSH brute-force attack simulation using Hydra
• Configurable attack parameters (threads, wordlist)
• Multiple target defense profiles
• Monitoring via Prometheus + Grafana
• Logs and detection with Zeek and Suricata
• fail2ban and CrowdSec integration
• Automated reporting and analytics

• CPU: 4–8 cores
• RAM: 4 GB+
• Tools: Hydra 9.5, nmap, Hashcat utils

• Configurations:
  • Baseline (no lockout)
  • Moderate (5 failures → 15 min lock)
  • Aggressive (2 failures → 60 min lock)

• Zeek, Suricata, Prometheus, Grafana
• 40 GB SSD, 8 GB RAM

More detailed requirements are documented here.

\[Attacker VM (Kali)]
|
\|---> \[Target VM 1: Baseline SSH]
\|---> \[Target VM 2: Moderate Lockout]
\|---> \[Target VM 3: Aggressive Lockout]
|
\[Monitoring Node: Zeek, Grafana]

• Subnet A: 10.10.10.0/24 – Attacker + Monitoring
• Subnet B: 10.10.20.0/24 – Target servers

git clone https://github.com/Swaraj-sync/Brute-Force-attack-Simulation-using-Hydra.git
cd Brute-Force-attack-simulation-using-Hydra

Provision VMs for attacker, targets, and monitoring nodes using VirtualBox, VMware, or Proxmox.

Install required tools:

sudo apt update
sudo apt install hydra nmap openssh-server fail2ban -y

Ensure SSH on targets is configured with:

PasswordAuthentication yes
MaxAuthTries 6

Run brute-force simulation using:

hydra -l admin -P /usr/share/wordlists/rockyou.txt ssh://192.168.1.100 -t 16

You can also use the automated runner:

./attack_runner.sh --protocol ssh --threads 16 --wordlist rockyou.txt

• ✅ 1 valid password found in 5.02 seconds
• ✅ Login: admin | Password: letmein123

Example Output:

[ssh] host: 192.168.1.100   login: admin   password: letmein123

Implemented and evaluated:

• Account Lockouts (PAM, fail2ban)
• Multi-Factor Authentication (MFA simulation)
• Rate Limiting
• Key-Based SSH Auth
• IP whitelisting and firewall rules

• Grafana Dashboards: Real-time attack metrics
• Zeek Logs: SSH connection analysis
• Suricata Rules: Custom brute-force detection alerts

• Hydra GitHub
• Kali Linux
• fail2ban
• CrowdSec
• Zeek
• Grafana

Feel free to fork this repo, submit pull requests, or report issues.