+- Sinisterly (https://sinister.ly)
+-- Forum: Computers (https://sinister.ly/Forum-Computers)
+--- Forum: Operating Systems (https://sinister.ly/Forum-Operating-Systems)
+--- Thread: Medusa Password Cracker (/Thread-Medusa-Password-Cracker)
Pages:
1
2
Medusa Password Cracker - .LiT - 09-05-2011
Medusa
Medusa is a fast, massively parallel, modular, login brute-forcer for network services made by the members of Foofus.net. It comes with backtrack and can be easily installed on any distro. It currently has modules for the following services: CVS, FTP, HTTP, IMAP, MS-SQL, MySQL, NCP (NetWare), PcAnywhere, POP3, PostgreSQL, rexec, rlogin, rsh, SMB, SMTP (VRFY), SNMP, SSHv2, SVN, Telnet, VmAuthd, VNC, and a generic wrapper module.
I'll just show you quickly how to crack a router's login using a dictionary attack with the HTTP module in Medusa. I tested this on my home router which is a very new Cisco router. It works perfect! Its 2011, I find it funny how home routers do not implement password lockout still to this day. Heres the exact command I used:
medusa -h 192.168.1.1 -U /usrlists/user.lst -P /pwdlists/darkc0de.lst -e ns -t 1 -v 5 -f -M http -m DIR:GET/index.asp
-h [TEXT] : Target hostname or IP address
-H [FILE] : File containing target hostnames or IP addresses
-u [TEXT] : Username to test
-U [FILE] : File containing usernames to test
-p [TEXT] : Password to test
-P [FILE] : File containing passwords to test
-C [FILE] : File containing combo entries. See README for more information.
-O [FILE] : File to append log information to
-e [n/s/ns] : Additional password checks ([n] No Password, [s] Password = Username)
-M [TEXT] : Name of the module to execute (without the .mod extension)
-m [TEXT] : Parameter to pass to the module. This can be passed multiple times with a
different parameter each time and they will all be sent to the module (i.e.
-m Param1 -m Param2, etc.)
-d : Dump all known modules
-n [NUM] : Use for non-default TCP port number
-s : Enable SSL
-g [NUM] : Give up after trying to connect for NUM seconds (default 3)
-r [NUM] : Sleep NUM seconds between retry attempts (default 3)
-R [NUM] : Attempt NUM retries before giving up. The total number of attempts will be NUM + 1.
-t [NUM] : Total number of logins to be tested concurrently
-T [NUM] : Total number of hosts to be tested concurrently
-L : Parallelize logins using one username per thread. The default is to process
the entire username before proceeding.
-f : Stop scanning host after first valid username/password found.
-F : Stop audit after first valid username/password found on any host.
-b : Suppress startup banner
-q : Display module's usage information
-v [NUM] : Verbose level [0 - 6 (more)]
-w [NUM] : Error debug level [0 - 10 (more)]
-V : Display version
-Z [NUM] : Resume scan from host #
RE: Medusa Password Cracker - hackthem - 09-05-2011
Post download links for dis cracker.
RE: Medusa Password Cracker - hackthem - 09-05-2011
Post download links for dis cracker.
RE: Medusa Password Cracker - .LiT - 09-06-2011
(09-05-2011, 11:51 PM)hackthem Wrote: Post download links for dis cracker.
just type sudo apt-get install medusa if you use a debian based distro.
But you can also download from here. http://www.darknet.org.uk/2006/05/medusa-password-cracker-version-11-now-available-for-download/
RE: Medusa Password Cracker - .LiT - 09-06-2011
(09-05-2011, 11:51 PM)hackthem Wrote: Post download links for dis cracker.
just type sudo apt-get install medusa if you use a debian based distro.
But you can also download from here. http://www.darknet.org.uk/2006/05/medusa-password-cracker-version-11-now-available-for-download/
RE: Medusa Password Cracker - akitta - 09-06-2011
Hydra can be used also but it's better in CLI than GUI (gtk-hydra).
I must say that i find medusa slower but more stable than hydra.
RE: Medusa Password Cracker - akitta - 09-06-2011
Hydra can be used also but it's better in CLI than GUI (gtk-hydra).
I must say that i find medusa slower but more stable than hydra.
RE: Medusa Password Cracker - .LiT - 09-07-2011
(09-06-2011, 12:25 PM)akitta Wrote: Hydra can be used also but it's better in CLI than GUI (gtk-hydra).
I must say that i find medusa slower but more stable than hydra.
Man, i've never got Hydra to work for some reason I probably just need to do more testing with it though. And yeah CLI > GUI for sure.
RE: Medusa Password Cracker - KaiT_AleX - 09-08-2011
I love Meduse.. Hydra has bug on bt5...
VERY GOOD TUTORIAL !
RE: Medusa Password Cracker - iMarcus - 09-10-2011
Looks like ill be removing my virus software temp, while I use this stuff
Why do they all get deleted by my antivirus