BeginnerTools

Medusa Guide: Parallel Network Login Auditor

Learn Medusa for parallel network authentication testing with support for multiple protocols, modular design, and practical security assessment examples.

#medusa#password attacks#brute force#authentication testing#network security

Why You Need Medusa

You need to test credentials against multiple network services in parallel — Medusa is a massively parallel login auditor that supports SSH, FTP, HTTP, SMB, RDP, and many more protocols. Its modular design and parallel threading make it faster than sequential tools for large-scale password testing.

Prerequisites

Understanding of network authentication protocols

Familiarity with the Linux command line

Authorization for testing

Installation

sudo apt install medusa

Basic Usage

medusa -h 192.168.1.100 -u admin -P passwords.txt -M ssh

Key Options

| Option | Description |

|--------|-------------|

| -h HOST | Target host |

| -u USER | Single username |

| -U FILE | Username file |

| -p PASS | Single password |

| -P FILE | Password file |

| -M MODULE | Module name |

| -t THREADS | Thread count |

| -f | Stop on first success |

| -o FILE | Output file |

| -d | List modules |

Protocol Examples

# SSH
medusa -h 192.168.1.100 -U users.txt -P passwords.txt -M ssh

# FTP
medusa -h 192.168.1.100 -U users.txt -P passwords.txt -M ftp

# SMB
medusa -h 192.168.1.100 -u administrator -P passwords.txt -M smbnt

# MySQL
medusa -h 192.168.1.100 -u root -P passwords.txt -M mysql

Listing Modules

medusa -d

Common Mistakes

Too many threads trigger lockouts. Wrong module selection. Forgetting -f to stop on success.

Best Practices

Start with few threads. Use targeted credentials. Log everything with -o.

Related Tools

**Hydra**: Similar parallel login cracker

**Ncrack**: High-speed network cracker

**Patator**: Multi-purpose brute-forcer

[Hydra Guide](/articles/hydra-guide)

[CeWL Guide](/articles/cewl-guide)

[Password Security Guide](/articles/password-security-guide)

Summary

Medusa is a massively parallel network login auditor with modular protocol support.

Knowledge Check

How is Medusa different from Hydra?

What does `-M` specify?

How to list all modules?

Default thread count?

Why use `-f` flag?

Frequently Asked Questions

What is Medusa?

Medusa is a massively parallel network login auditor that tests credentials against multiple protocols including SSH, FTP, SMB, MySQL, and HTTP. It is pre-installed on Kali Linux and supports modular protocol testing.

How is Medusa different from Hydra?

Medusa uses a threaded architecture for parallel logins across multiple hosts simultaneously. Hydra is more commonly used for single-target attacks. Medusa excels when testing many services or hosts in parallel.

What does the -M flag specify?

The `-M` flag specifies the protocol module to use, such as `ssh`, `ftp`, `smbnt`, or `mysql`. List available modules with `medusa -d`.

How do you list all available modules?

Run `medusa -d` to display all supported protocol modules. Each module handles authentication for a specific service like HTTP, SSH, FTP, or database systems.

What is the default thread count?

Medusa defaults to 10 threads. Use `-t` to adjust: `-t 5` for slower, stealthier testing or `-t 20` for faster attacks. Too many threads may trigger account lockouts.

Why use the -f flag?

The `-f` flag stops Medusa after finding the first valid credential, preventing unnecessary continued testing. This is useful when you only need one successful login per account.

How do you brute force SMB with Medusa?

Use `medusa -h target -u admin -P passwords.txt -M smbnt` to test SMB authentication. The smbnt module handles NTLM authentication for Windows file shares.

How do you test multiple hosts at once?

Use `-H hosts.txt` with a file containing one host per line. Medusa tests all hosts in parallel with the same credentials, efficient for network-wide assessments.