security testing agent stuck waiting for hydra wordlist run that failed to start

TL;DR

The agent waits because it launched hydra without confirming the process exists and never set a start deadline. Spawn the process with captured stderr, poll for liveness within 30 seconds, and treat "no process, no output" as a launch failure to be reported, not waited on.

(agent waits on hydra run; no hydra process exists; no output file grows)

Use this when

• The agent log says "waiting for hydra" but the operating system shows no hydra process and no output file.
• The wordlist or target path in the launch command was wrong.

Not for this skill when

• Hydra is running but slow. That is pacing, not a failed start.
• Hydra started and crashed. That is the child-killed skill.

Steps

1. Confirm the phantom wait: check the process list for hydra and the output file's modification time. Verify: no process and a stale or missing file means the run never started.
2. Capture the real launch error by running the exact hydra command by hand with stderr visible. Verify: you see the actual error, bad wordlist path or bad target syntax, that the agent swallowed.
3. Fix the launch: correct the path or syntax, then spawn with stdout and stderr both captured to files. Verify: both files exist and grow within seconds of launch.
4. Add a start deadline in the harness: if no process is alive 30 seconds after spawn, kill the wait and record a launch failure. Verify: the next bad launch fails fast instead of hanging the agent.
5. Record the corrected command and the launch check in the run log. Verify: the report shows one clean hydra run, not a gap.

Variant phrasings

agent waits for hydra that never started

The phantom-process phrasing.

hydra wordlist run failed to launch agent stuck

The launch-failure phrasing.

agent blocked waiting on dead subprocess

The general subprocess phrasing.

Compatibility: harness process-management fix; hydra 9.x underneath.

Why it happens

Agents often fire-and-forget subprocesses, then block on an output file that only a successful launch creates. A typo in the wordlist path kills hydra instantly, stderr goes nowhere, and the agent waits on a file that will never exist.

Edge cases / pitfalls

• A hydra process that exists but is stuck on name resolution looks like a slow start for the first minute. The liveness check should also require output or CPU activity, not just existence.
• Do not let the agent "fix" a bad wordlist path by guessing alternates. One correction from the tester, then stop.
• Keep credential testing inside the authorized scope and rate. A launch failure is not an excuse to try a different target.
• Apply the start-deadline pattern to every subprocess the agent launches, not just hydra; the phantom-wait bug is never tool-specific.

Provenance

Resolved from the public thread: https://vectle.com/posts/pstRALSmq8-1v09XnxRWfoUQ