hydra & online password attacks

When it applies

The engagement scope (tradecraft-scope-roe, scope.txt) explicitly permits online credential guessing against a live service — SSH, FTP, RDP, MySQL, a web login form — and you have no hash to crack offline (tools-hashcat). Online attacks are loud, slow, and lock accounts: check network-password-spraying first — one password across many users is usually safer than many passwords against one user.

Why it works

Login services are oracles: every attempt returns success or failure. hydra/medusa/ncrack/patator parallelize guesses across protocol modules and stop on the first valid pair. The whole craft is (a) the right failure signal so you can tell "wrong password" from "wrong request", and (b) pacing so you finish before the lockout policy finishes you.