Password Attacks
Ncrack is a high-speed network authentication cracking tool built by the Nmap team. It supports RDP, SSH, HTTP, SMB, FTP, and more protocols.
sudo apt install ncrack
ncrack [options] <target>
Ncrack is a high-speed network authentication cracking tool built by the Nmap team. It specializes in cracking credentials for connection-oriented protocols like RDP, SSH, SMB, and FTP, with native integration with Nmap scan results.
Created in 2008 as part of the Nmap ecosystem, Ncrack's key advantage is its ability to import targets directly from Nmap XML output. After discovering services with Nmap, you can feed the results directly into Ncrack for credential testing without manual target configuration.
Ncrack supports over 12 protocols and provides precise timing control for stealthy operations. It's designed for speed and efficiency, making it ideal for penetration testing workflows that start with Nmap reconnaissance.
ncrack -hDisplay the help summary with all options and supported modulesncrack --versionPrint the Ncrack version number and exitncrack ssh://10.10.10.10Crack SSH on a host using Ncrack's built-in default credential listsncrack -p 22 10.10.10.10Attack a host on a specific port, auto-detecting the SSH servicencrack -p ssh,rdp,ftp 10.10.10.10Attack multiple services on a host by service namencrack -U users.txt -P pass.txt ssh://10.10.10.10Use username and password wordlists against SSHncrack --user root,admin ssh://10.10.10.10Supply usernames inline as a comma-separated listncrack --pass password123,letmein ftp://10.10.10.10Supply passwords inline as a comma-separated listncrack -iL target.txt -p sshRead a list of target hosts from a file and attack SSHncrack -p rdp 192.168.1.0/24Attack the RDP service across an entire CIDR subnetncrack -f -U users.txt -P pass.txt ssh://10.10.10.10Stop attacking each host as soon as one valid credential is foundncrack -T4 ssh://10.10.10.10Apply the aggressive timing template for faster attacksncrack -g cl=3,cr=2,to=1h ssh://10.10.10.10Set global timing options: concurrent logins, retries, and timeoutncrack "ssh://10.10.10.10,CL=4,at=6"Set per-service options appended after the service specificationncrack -oN results.txt ssh://10.10.10.10Write results to a file in normal human-readable formatImport Nmap XML scan results directly for credential testing of discovered services.
Test Windows Remote Desktop services for weak administrative passwords.
Brute-force SSH services across multiple hosts with Nmap-discovered targets.
Test Windows SMB shares for default or weak credentials.
Test multiple protocols simultaneously with a single Ncrack command.
Ncrack is a legitimate network-authentication auditing tool from the Nmap project, but it may only be used against hosts and accounts you own or have explicit written authorization to test. Unauthorized brute-forcing of remote services is illegal and can cause lockouts and service disruption. Keep your engagement's scope and permission documented.
Yes, Ncrack ships with the standard Kali Linux distribution. On a minimal image you can install it with `sudo apt install ncrack`. Check it is ready with `ncrack --version`.
Both are high-speed parallel login auditors. Ncrack is developed by the Nmap team and shares Nmap's timing model and output style, making it a natural fit alongside Nmap scans. Medusa is an independent tool with its own module set; many testers choose based on protocol support and which output format suits their workflow.
If an Ncrack run is interrupted, it writes a restore file and prints the exact `ncrack --resume <file>` command to continue. Running that command resumes from where it stopped rather than restarting the entire credential space. This is helpful during long authorized tests that must be paused.
Provide a single user with `--user` or a list with `-U users.txt`, and likewise `--pass` or `-P passwords.txt` for passwords. You can also supply combined `user:pass` pairs with `-C combo.txt`. Credentials can be set inline per service, e.g. `ncrack -U users.txt -P passwords.txt ssh://10.10.10.10`.
Against an authorized target, run `ncrack -U users.txt -P passwords.txt ssh://10.10.10.10`. Ncrack also accepts Nmap-style port syntax, so `ncrack -p 22 10.10.10.10` targets SSH by port. Use the `-T` timing options responsibly to avoid overwhelming production systems you are permitted to test.
Information Gathering
Network scanner that discovers services for Ncrack credential testing.
Password Attacks
More flexible brute-forcer with additional protocols and HTTP form support.
Password Attacks
Multi-host brute-forcer for network-wide credential testing campaigns.
Password Attacks
GPU-accelerated offline cracker for hashes extracted from Ncrack-discovered services.
Password Attacks
Multi-host parallel scanner for expanding credential testing beyond Ncrack's scope.
Presents successfully validated credentials alongside the relevant IP address and service name.
This tool is designed for authorized security testing, educational purposes, and legitimate network administration only. Unauthorized access to computer systems is illegal.