Introduction
Online credential testing sends login attempts to a running service, so its scope, candidate count, concurrency, and stopping condition must be clear. A reported success is strongest when the credential also authenticates to the actual target.
This lab supplies a dedicated local SSH service and one weak training account. You will run a bounded Hydra check, preserve its result, and confirm the recovered login with a single remote identity command.
Run a Small, Authorized SSH Credential Check
In this step, you will use Hydra against one supplied account on a dedicated local training service.
Enter Kali and choose the shared workspace:
kali
cd /home/labex/project
Unlike John's offline hash comparison, Hydra sends authentication attempts to a live service. Each attempt can affect service logs, load, or account policy. This exercise authorizes only the supplied training-login account on 127.0.0.1:12222 using the small provided list. The host's SSH service and other accounts are outside scope.
Read the candidate list before testing:
cat candidates.txt
There are three training candidates, one per line. No larger wordlist or password generation is needed.
Hydra's -l selects one login name; -P reads password candidates from a file; -s selects the non-default service port; -t 1 limits concurrency to one task; -f stops after the first successful pair; and -o saves successful results. The ssh:// target selects the SSH protocol module:
hydra -l training-login -P candidates.txt -s 12222 -t 1 -f -o hydra-results.txt ssh://127.0.0.1
Wait for the bounded run to finish. The successful result should name port 12222, the SSH service, the assigned login, and a candidate password. Version banners, timing, and attempt-order details may vary.
Read the saved result:
cat hydra-results.txt
Look for the successful pair for training-login. A connection error, unsupported protocol, or exhausted candidate list is different from a valid authentication result; do not treat every completed Hydra run as success.
Confirm the Recovered Account with SSH
In this step, you will verify that the reported credential actually authenticates to the supplied service and save the remote identity result.
The saved Hydra result should show the training password pebble7 for training-login. This is an intentionally weak fixture credential, not a password to reuse elsewhere.
The SSH client can run one command remotely and then disconnect. Its lowercase -p chooses the non-default SSH port; user@address chooses the account and endpoint. The final whoami runs under the authenticated remote account. Redirect that command's output into a local result file:
ssh -p 12222 training-login@127.0.0.1 whoami > authenticated-user.txt
On the first connection, SSH asks whether to trust this training service's host key. You are connecting to the dedicated local endpoint prepared for this exercise; type yes and press Enter. When the password prompt appears, type the recovered password pebble7 and press Enter. Password characters are not echoed. This creates no interactive remote shell: after the remote command finishes, you return to your Kali prompt.
Read the saved identity:
cat authenticated-user.txt
Expected output:
training-login
This checks the credential against the actual service rather than relying solely on a tool's result line. The login is local to the isolated training SSH service; the host learner's account and SSH configuration remain unchanged.
Summary
You distinguished online login attempts from offline recovery, selected one SSH account and custom port, limited concurrency, and stopped on the first success. You saved the result and confirmed that the reported credential really authenticated to the supplied account.
