PT0-002 Vulnerability Discovery and Analysis Practice Question

A tester needs to brute-force SSH credentials on a target. Which tool is most appropriate for this task?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Hydra

Hydra is a versatile online brute-force tool supporting many protocols including SSH.

Answer analysis

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Aircrack-ng
Why it's wrong here
Aircrack-ng is a specialized suite for wireless network security testing, designed to capture packets and crack WEP and WPA-PSK keys via offline analysis. It performs no interactive authentication attempts against a live SSH service and does not support SSH as a target protocol, so it cannot brute-force credentials over the network.
✗
Hashcat
Why it's wrong here
Hashcat is a high-speed offline password recovery tool that operates on pre-captured hash values (e.g., /etc/shadow SHA-512, NTLM, bcrypt). It requires a hash file as input and never contacts a target service, so it cannot perform online SSH brute-force attacks where each guess is sent to the sshd daemon.
✓
Hydra
Why this is correct
Hydra is the correct choice because it is a network logon cracker that supports the SSH protocol among hundreds of others. It can supply username/password pairs from wordlists, perform parallel connection attempts, and handle SSH's banner and authentication exchange, making it ideal for online brute-force testing against a live target.
✗
John the Ripper
Why it's wrong here
John the Ripper is a versatile offline password cracker that works by comparing candidate hashes against a pre-computed or incremental set of password hashes. It is not designed to initiate network connections or send authentication requests to a remote SSH service, so it cannot be used for active online brute-force attacks directly.

Go deeper