Guide
Hydros is an advanced WordPress credential validation tool that processes url:log:pass or email:pass data with intelligent enumeration capabilities. This guide will walk you through configuring Hydros to maximize success rates through subdomain discovery, username enumeration, and comprehensive account analysis.
Before You Begin
Verify that your base file and proxy list are correctly formatted before starting. This will help avoid processing errors.
Overview
Hydros validates WordPress credentials by processing files containing url:log:pass or email:pass entries. Beyond simple credential checking, it features:
- Subdomain Discovery: Automatically finds and tests subdomains using certificate transparency logs
- Username Enumeration: Discovers valid usernames through multiple WordPress vulnerabilities
- WooCommerce Analysis: Extracts e-commerce data, sales statistics, and payment gateway information
- Smart Processing: Continues testing even after finding valid credentials to maximize discovery
Interface
The Hydros interface is organized into collapsible sections:
- Files: Base and proxy file selection
- Performance: Thread count, timeout, and retry configuration
- Limits: Maximum subdomains and usernames to test
- Behavior Settings: Advanced enumeration options
- Statistics: Real-time progress and results
Configuration
Select the Base File
Choose the file containing credentials to validate. Hydros supports multiple formats:
Standard format: url:login:password
Examples:
https://example.com:admin:password123blog.example.com:user:passexample.com/wp-admin:admin:secret
Select the Proxies
Choose a file that contains your proxy list. Proxies should be listed in a valid format. Learn more about proxy formats
Test your proxies beforehand to ensure they are active and reliable.
Set Performance Parameters
Configure the number of concurrent threads (1-5000). Recommended settings:
- Low-end systems: 10-50 threads
- Mid-range systems: 50-200 threads
- High-end systems: 200-500 threads
Thread counts above 500 may cause instability. Monitor CPU and memory usage when increasing threads.
Configure Limits
Set maximum values for enumeration features:
Configure Behavior Settings
Enable advanced features to maximize discovery:
- Subdomain Enumeration: Discovers and tests all subdomains for the target domain
- Fetch Usernames: Attempts to discover valid usernames when provided credentials fail
Enumeration features significantly increase processing time and may trigger security measures.
Start the Validation Process
Click the Execute button to begin processing. The Statistics section displays:
- Attempts: Total login attempts made
- Valid: Successful logins found
- Invalid: Failed login attempts
- Errors: Connection or processing errors
- Time: Elapsed processing time
- CPM: Checks per minute (performance metric)
Use the Stop button to halt processing at any time. Results are saved continuously.
Best Practices
Troubleshooting
Frequently Asked Questions
By following this guide, you'll be able to validate WordPress credentials efficiently while leveraging Hydros' advanced enumeration capabilities for comprehensive discovery. Remember to use quality proxies and configure settings appropriately for your use case.