Password Attacks
Ncrack is a high-speed network authentication cracking tool built by the Nmap team. It supports RDP, SSH, HTTP, SMB, FTP, and more protocols.
sudo apt install ncrack
ncrack [options] <target>
Ncrack is a high-speed network authentication cracking tool built by the Nmap team. It specializes in cracking credentials for connection-oriented protocols like RDP, SSH, SMB, and FTP, with native integration with Nmap scan results.
Created in 2008 as part of the Nmap ecosystem, Ncrack's key advantage is its ability to import targets directly from Nmap XML output. After discovering services with Nmap, you can feed the results directly into Ncrack for credential testing without manual target configuration.
Ncrack supports over 12 protocols and provides precise timing control for stealthy operations. It's designed for speed and efficiency, making it ideal for penetration testing workflows that start with Nmap reconnaissance.
ncrack -hDisplay the help summary with all options and supported modulesncrack --versionPrint the Ncrack version number and exitncrack ssh://10.10.10.10Crack SSH on a host using Ncrack's built-in default credential listsncrack -p 22 10.10.10.10Attack a host on a specific port, auto-detecting the SSH servicencrack -p ssh,rdp,ftp 10.10.10.10Attack multiple services on a host by service namencrack -U users.txt -P pass.txt ssh://10.10.10.10Use username and password wordlists against SSHncrack --user root,admin ssh://10.10.10.10Supply usernames inline as a comma-separated listncrack --pass password123,letmein ftp://10.10.10.10Supply passwords inline as a comma-separated listncrack -iL target.txt -p sshRead a list of target hosts from a file and attack SSHncrack -p rdp 192.168.1.0/24Attack the RDP service across an entire CIDR subnetncrack -f -U users.txt -P pass.txt ssh://10.10.10.10Stop attacking each host as soon as one valid credential is foundncrack -T4 ssh://10.10.10.10Apply the aggressive timing template for faster attacksncrack -g cl=3,cr=2,to=1h ssh://10.10.10.10Set global timing options: concurrent logins, retries, and timeoutncrack "ssh://10.10.10.10,CL=4,at=6"Set per-service options appended after the service specificationncrack -oN results.txt ssh://10.10.10.10Write results to a file in normal human-readable formatImport Nmap XML scan results directly for credential testing of discovered services.
Test Windows Remote Desktop services for weak administrative passwords.
Brute-force SSH services across multiple hosts with Nmap-discovered targets.
Test Windows SMB shares for default or weak credentials.
Test multiple protocols simultaneously with a single Ncrack command.
Information Gathering
Network scanner that discovers services for Ncrack credential testing.
Password Attacks
More flexible brute-forcer with additional protocols and HTTP form support.
Password Attacks
Multi-host brute-forcer for network-wide credential testing campaigns.
Password Attacks
GPU-accelerated offline cracker for hashes extracted from Ncrack-discovered services.
Password Attacks
Multi-host parallel scanner for expanding credential testing beyond Ncrack's scope.
Presents successfully validated credentials alongside the relevant IP address and service name.
This tool is designed for authorized security testing, educational purposes, and legitimate network administration only. Unauthorized access to computer systems is illegal.