Hydra Integration with DefectDojo
Hydra is an open-source parallelized network logon cracker that performs brute-force attacks to test authentication mechanisms across numerous protocols including SSH, FTP, HTTP, HTTPS, Telnet, RDP, MySQL, PostgreSQL, and over 50 other services by systematically testing username and password combinations from wordlists or custom dictionaries. The tool is designed for authorized penetration testing and security auditing to identify weak credentials and authentication vulnerabilities, enabling security professionals and system administrators to assess password strength and improve security posture before malicious actors can exploit these weaknesses.
Data Granularity: What Gets Imported
The following fields are captured from Hydra results and surfaced in DefectDojo findings:
| Field | Source | Notes |
|---|---|---|
| Title | Finding name from the scan | Matched to the tool's own naming |
| Severity | Critical / High / Medium / Low / Info | Mapped from the tool's own severity scale |
| Description | Finding detail from the report | Includes what the issue is and why it matters |
| Mitigation | Remediation guidance | Where the tool provides it |
Importing Into DefectDojo
Use the DefectDojo import API to create a new Test under the relevant Engagement for your product. The request body:
{
"scan_type": "Hydra",
"engagement": "<engagement-id>",
"file": "results.json"
}