Medusa

Medusa is a legitimate credential-auditing tool, but brute-forcing logins is only lawful against systems and accounts you own or have explicit written permission to test, such as a scoped penetration-testing engagement. Testing third-party services without authorization is illegal and can also trigger account lockouts and alerts. Always confirm your scope in writing first.

Yes, Medusa is part of the default Kali Linux tool set. If it is absent on a minimal install, run `sudo apt install medusa`. Confirm it is available with `medusa -h`.

Against a host you are authorized to test, the syntax is `medusa -h 10.10.10.10 -U users.txt -P passwords.txt -M ssh`. Here `-h` sets the target, `-U` and `-P` supply the username and password lists, and `-M ssh` selects the SSH module. Add `-f` to stop after the first valid credential is found.

Medusa prints a resume map when interrupted, and you can restart from it using the `-Z` flag with that value. This avoids re-testing combinations already checked. Logging the session to a file with `-O medusa.log` makes it easy to recover the resume string later.

Connection errors usually mean the service is filtered by a firewall, the port is closed, or the target is rate-limiting or blocking repeated attempts. Verify the port is open first (for example with Nmap) and reduce concurrency using `-t` for authorized tests. Some services also drop connections after several failed logins.

All three are parallel network login auditors. Medusa emphasizes stable, modular parallelism; Hydra supports the widest range of protocols; and Ncrack is built by the Nmap team and integrates cleanly with Nmap output. Choosing among them usually comes down to which protocols you need and personal workflow preference.

Medusa is a speedy, parallel, and modular login brute-forcer that supports over 20 network protocols. Its key advantage is multi-host scanning capability, allowing it to brute-force credentials across multiple hosts simultaneously for network-wide auditing.

Run medusa -d to display all available protocol modules. Each module has specific options you can view with medusa -M <module> -m OPT:VALUE.

Medusa excels at multi-host parallel scanning and has a modular architecture. Hydra supports more protocols (50+ vs 20+) and has HTTP form attack capabilities. Medusa is better for network-wide scanning; Hydra for single-target deep testing.

Create a file with target IPs (one per line) and use the -H flag: medusa -H hosts.txt -u admin -P passwords.txt -M ssh. Medusa will test all hosts simultaneously.

Medusa supports 20+ protocols including SSH, FTP, Telnet, HTTP, HTTPS, SMB, MySQL, PostgreSQL, MSSQL, Oracle, VNC, SNMP, POP3, IMAP, and more. Each protocol has its own module with specific options.

Use Ctrl+C to gracefully stop Medusa. It saves partial results to the log file. You can also set timeouts with -T for per-connection timeouts and -f to stop after first successful login per host.

Use -U for username file and -P for password file: medusa -H targets.txt -U users.txt -P passwords.txt -M ssh. Each line in the files is tested as a single credential pair.

Yes, create a list of common default credentials (admin:admin, root:root, etc.) and use it with -C for combined credential files. Medusa is commonly used to audit default credentials across server fleets.

Medusa outputs results to stdout and optionally to a log file with -O. Use -v for verbose output showing each attempt, or -f for fast mode showing only successful logins.

Medusa is already multi-threaded. Use -T to set connection timeout and -f for first-success-per-host mode. For maximum speed, reduce timeout values and use -M with the fastest module for the protocol.

Use -C for combined username:password files: medusa -H targets.txt -C credentials.txt -M ssh. Each line should contain username:password pairs. This is faster than using separate -U and -P files for credential testing.

Yes, Medusa's HTTP module supports basic authentication and form-based login. Use -m DIR:/login and provide form parameters. For complex forms, tools like Hydra with the http-form module may be more suitable.

Use the -f flag to stop after the first successful login per host. Without -f, Medusa continues testing all remaining credentials, which wastes time once valid credentials are found.

Medusa primarily supports IPv4 addresses. For IPv6 scanning, use IPv4-mapped addresses or consider Hydra as an alternative that has better IPv6 support for certain protocols.

Use -U to specify a file containing usernames (one per line): medusa -H target.txt -U users.txt -P passwords.txt -M ssh. Each line in the username file is tested against each password.

Medusa continues testing remaining credentials but the locked account will show as a failure. Use -f to stop on first success and -T for timeouts to reduce lockout risk. Monitor target logs for lockout patterns.

Yes, use the postgres module: medusa -h db.server -u postgres -P passwords.txt -M postgres -m PORT:5432. Medusa tests PostgreSQL credentials using the pg_hba.conf authentication method.

Use -O to save all output to a log file: medusa -h target.txt -U users.txt -P pass.txt -M ssh -O medusa.log. Use -v for verbose logging showing each attempt, or -f for only successful logins.

Medusa scans multiple hosts in parallel but tests one protocol module per run. To test multiple services, run separate Medusa instances for each protocol (SSH, FTP, etc.) against the same targets.