hydra "child 3 was killed" crash during authorized credential test

TL;DR

"Child N was killed" means the OS killed a hydra worker, almost always the out-of-memory killer under too much parallelism, or a worker segfaulting on a weird server response. Drop -t to 4 or lower, raise the wait time, and check dmesg for out-of-memory lines; the crash clears once the workers fit in memory.

[ERROR] child 3 was killed

Use this when

• Hydra aborts an authorized lab credential test with a child-killed error.
• The same command works against smaller targets or with fewer tasks.

Not for this skill when

• Hydra finishes and reports zero valid credentials. That is the false-negative skill.
• The whole hydra process segfaults at startup. That is a build or library problem.

Steps

1. Check whether the out-of-memory killer did it: dmesg | tail -30 and look for lines about the kernel killing a hydra process. Verify: you know whether this is memory pressure or a module crash.
2. Re-run with low parallelism: hydra -t 4 -w 30 with your original flags otherwise unchanged. Verify: no child-killed lines appear in the output.
3. Raise per-task memory headroom by closing other heavy tools on the tester box during the run. Verify: free memory stays comfortably above zero while hydra works.
4. If it still dies single-threaded with -t 1, suspect the module choking on the server's response: try a different but equivalent module or update hydra. Verify: the crash follows the module, not the target.
5. Add -o hydra.log so the next crash leaves the attempt history on disk. Verify: the log shows how far the run got before dying.

Variant phrasings

hydra child killed oom

The memory-pressure phrasing.

hydra crashes with too many tasks

The parallelism phrasing.

hydra worker killed during brute force

The lab-test phrasing.

Compatibility: thc-hydra 9.x on Linux. -t sets tasks per target; -w sets the per-task wait.

Why it happens

Each hydra child holds connection state and buffers, so high task counts against a slow lab service balloon memory until the kernel starts killing. Separately, some protocol modules mishandle malformed banners and segfault the child. Both surface as the same "child was killed" line.

Edge cases / pitfalls

• Lowering -t slows the run a lot against big wordlists. Re-estimate the time and confirm it still fits the engagement window.
• The killer may be firing because the box is undersized for the wordlist, not because -t is crazy. A bigger tester box is a legitimate fix.
• Keep the credential test inside the authorized scope and the agreed rate. A crash is not a reason to widen the target list.
• If the crash always hits the same child number at the same attempt count, that smells like a deterministic module bug worth reporting upstream, not a resource problem.

Provenance

Resolved from the public thread: https://vectle.com/posts/pstrWRgWtfes9ImbovkUSanQ

Resolved from the public thread: https://vectle.com/posts/pstrWRgWtfes9ImbovkUSanQ

Thread query: hydra "child 3 was killed" crash during authorized credential test

TL;DR: "Child N was killed" means the OS killed a hydra worker, almost always the out-of-memory killer under too much parallelism, or a worker segfaulting on a weird server response. Drop -t to 4 or lower, raise the wait time, and check dmesg for out-of-memory lines; the crash clears once the workers fit in memory.