Throttle or get banned

Guide

Hydra can open hundreds of parallels. Labs and real apps will lock accounts, ban your IP, or trip WAF rules. Throttle is not optional politeness — it is how you stay in the experiment.

Why it matters

Rate limits exist to stop exactly this. On Laden, the rate-limit lab teaches the defensive side. As an attacker-in-lab, -t 4 (or lower) keeps logs readable and mimics what a careful operator does under a signed SOW.

How-to

# Lab login form example (authorized targets only)
hydra -l admin -P wordlist.txt TARGET http-post-form \
  "/login:user=^USER^&pass=^PASS^:F=Invalid" -t 4 -V

# SSH lab
hydra -L users.txt -P rockyou.txt -t 4 ssh://TARGET

• Stop when you see lockouts — note it for the report instead of burning the account.
• Production without written scope: do not run Hydra. Ever.
• Prefer password sprays (few passwords, many users) over classic brute when simulating real ops — still only in scope.