Hydra vs. PortSwigger Burp Suite

One scenario that fits well Hydra's ability is to test the strength of Drupal usernames and passwords. So, as an example, if we have a Drupal site at some HTTP web address, we could use lots of methods in order to collect a list with some valid users. After we create the list and also the list of some possible passwords we can try to initiate a Hydra brute force attack. Hydra for example is not suited for finding the vulnerabilities of a host, for this other solutions can be used.

Incentivized

Burp Suite is a good general tool to test websites as long as your website is not too large or you have the time for it to complete. We have some websites that only about five to ten minutes for Burp Suite to complete an attack and a spider only takes about two minutes. Other websites have taken a few hours to complete. I have seen a tester actually run Burp Suite against one of our websites and it took all day to complete.

Incentivized

• One of most important thing is that Hydra's ability to perform HTTP post form attacks.
• The tool also can be used to attack a great number of protocols.
• The source code of the tool/software is also available for others (so it is not a closed source one).
• A good thing about this tool is also the support available and it also has a high ranking on GitHub (over 1000 stars).

Incentivized

• The passive scan feature is really awesome, it kind of covers areas that you might miss.
• The CSRF POC is really helpful to my team. It helps development team see the issue and understand it.
• Burp intruder and repeater are the features I myself and my team uses the most as it helps us use our payloads in a variety of different ways.
• Active scan helps the team to ensure coverage for the whole application.

• It is not a straightforward tool to use, it needs certain dependencies to be installed so it can function as intended by its creators. This is one of the most important steps that need to be done while configuring the tool as one needs.
• Sometimes the tool gives False Positives passwords.
• There are some issues in the functionality of the tool itself (like some bugs, for example affecting the running and hanging process after a number of tries), but most of them have a solution and there is big community support for the tool.

Incentivized

• The interface is a big problem: No matter how many features a software provides you, if the features are not well presented, you will miss most of them when they are actually required. The presentation of the software should be improvised and made more presentable.
• Tutorial videos for beginners: This software lacks a lot in tutorials. A beginner almost wastes most of the time in finding and understanding the features and the implementation of the same. The software vendor should work on providing more in-depth videos so that people can learn and understand the concepts.

Incentivized

The workflow between features like Proxy, Scanner, Intruder, and Repeater feels seamless, making it easy to intercept, manipulate, and analyze web traffic. Despite its advanced capabilities, the tool remains accessible and flexible, which significantly speeds up testing without overwhelming the user.

Incentivized

BurpSuite does not have an amazing customer support. All the major help that you will find is from public forums and Google. Although you will find all the required information on Google, still at time professional support helps you solve the problem in much less time and make your operations go smoothly.

Incentivized

There are many other tools similar to Hydra, one of them being "John the Ripper ". Notable differences are that while John the Ripper works offline, Hydra works online; also Hydra is more popular and with a wider usage as it supports Windows, Linux, and macOSX. An important thing is that both software are free to use, making both very useful tools. We can note that JTR has also a "pro" version that is not free to use and it is more optimized for speed and performance and focused on a specific operating system, while Hydra is free and offers all features at no cost.

Incentivized

Each tool is specific and are good for what they do. While Burp Suite can perform some level of the same functions, somehow security consultants prefer these tools as additional to the Burp Suite. Maybe due to open source and easy setup when compared to Burp Suite. But Burp Suite allows for one tool for many templates for each project.

Incentivized

• Our business objectives are accomplished using the tool as Hydra covers our needs for a free password cracking tool.
• The tool is a free one that has a lot of advantages because it is a powerful one to use for the specific task of performing some activities that are related to penetration testing.
• The services that our business provides for several clients in the field of penetration testing are at the level our customers are expecting.

Incentivized

• Scanned 100% of the orgs public facing web sites with a small team of analysts.
• Provided a reputable second opinion source to back up the other product in use i.e. Webinspect.
• Pro version $350 is amazing ROI, considering the thwarted attacks and that it's competition is priced in the tens of thousands last I checked.
• No successful hacks. Q.E.D. :-)

Incentivized