Lion Cipher Lab
Spray and brute-force your OWN login (Hydra) — and see why weak passwords fall
- Penetration Testing / Red Team
- Intermediate
- ~60 min
- Free · no account required
Why it matters
Weak and reused passwords are still one of the most common ways real intrusions begin, and password spraying is engineered specifically to defeat the first defence most teams reach for — account lockout. Reading about it is abstract; watching it happen against a login YOU control makes it click. When you spray a single weak password across a whole list of usernames and see exactly one account fall — the one that reused 'Summer2026' — while the accounts with long random passwords hold, you understand in your gut why length and uniqueness matter, why lockout alone is a trap, and why…
What you'll learn
- the difference between brute force, password spraying, and credential stuffing
- standing up a disposable SSH login target you own
- using Hydra (-l/-L for users, -p/-P for passwords) against a login service
- building and using a wordlist
- why spraying one password across many accounts evades account lockout
- reading an attack's success line and mapping it to a weak/reused password
- authorized-testing discipline: your own service on an isolated network only
Steps in this lab
- Three attacks that all guess passwords — but differently
- Rules of engagement — read this before you install anything
- Install Hydra
- Stand up a login target you own (a disposable SSH service)
- Build your wordlist and your user list
- Attack #1 — brute force ONE account
- Attack #2 — spray ONE password across MANY accounts
- Why it worked — and what actually stops it
- Tear down the target