ncrack
Network authentication cracking
SYNOPSIS
ncrack [ <options> ] <target specifications>
PARAMETERS
-U
Specify a file containing a list of usernames to try.
-P
Specify a file containing a list of passwords to try.
-L
Specify a file containing user:password combinations (one per line).
-u
Specify a single username to attempt against the target.
-p
Specify a single password to attempt against the target.
-T
Set the timing template (e.g., Normal, Aggressive) to control scan speed.
--delay
Set a minimum delay between probes to avoid overwhelming the target.
--connections
Set the maximum total number of concurrent connections Ncrack will use.
--probe-timeout
Set the timeout for a single authentication probe.
--max-retries
Set the maximum number of retries for failed authentication probes.
-oN
Output the scan results in normal readable format to the specified file.
-oX
Output the scan results in XML format to the specified file.
-oA
Output in all common formats (normal, XML, greppable) using the specified basename.
-v
Increase the verbosity level, showing more details about the scan process.
-vv
Increase the verbosity level even more for extensive details.
-d
Set the debugging level (0-9) to output internal debug messages.
--reason
Display the reason for each successful or failed authentication attempt.
--resume
Resume a previously interrupted cracking session from a saved file.
--script
Load and execute an Ncrack script (written in Lua) for custom logic.
--script-args
Provide arguments to Ncrack scripts.
--no-host-discovery
Skip the initial host discovery phase and assume targets are online.
-h, --help
Display the help message and exit.
--version
Display Ncrack's version number and exit.
DESCRIPTION
Ncrack is a powerful, high-performance network authentication cracking tool that is part of the Nmap security scanner project. It's designed to help security professionals and ethical hackers test the strength of network authentication credentials against various services. Unlike traditional cracking tools, Ncrack is built with a focus on speed and flexibility, utilizing Nmap's robust networking capabilities. It supports a wide array of protocols, including SSH, FTP, HTTP, SMB, POP3, Telnet, RDP, VNC, MySQL, PostgreSQL, and more. Ncrack can perform dictionary attacks using wordlists, brute-force attacks, or a combination of both. Its modular architecture allows for easy extension and customization, including scripting capabilities via Lua, making it a versatile tool for auditing the security of network services against weak or common passwords. Its primary use cases involve penetration testing and ensuring robust password policies are enforced.
CAVEATS
Ncrack is a powerful tool designed for security auditing and should only be used on systems for which you have explicit, written permission. Unauthorized use can lead to severe legal consequences. Running Ncrack, especially with aggressive timing or large wordlists, can generate significant network traffic and consume considerable system resources on both the attacker and target machines. It's crucial to understand that Ncrack focuses on authentication cracking and is not a comprehensive vulnerability scanner; it won't detect other types of security flaws. Results should be interpreted carefully, as network issues or specific service behaviors can sometimes lead to false positives or negatives.
TARGET SPECIFICATION
Ncrack requires a target to operate on. This can be a single host IP address or hostname. For specific services, the target can be specified using a URL-like format such as protocol://host[:port]. For example, ssh://192.168.1.1 or http://example.com:8080.
SUPPORTED PROTOCOLS
Ncrack supports a wide range of common network authentication protocols, making it highly versatile. These include, but are not limited to: SSH, FTP, HTTP (Basic, Digest, NTLM), SMB, POP3, IMAP, Telnet, RDP, VNC, MySQL, PostgreSQL, Redis, SIP, and various VPN protocols. The specific protocol handler is often inferred from the port or explicitly stated in the target specification.
LUA SCRIPTING ENGINE
Ncrack incorporates a powerful Lua-based scripting engine, similar to Nmap's NSE (Nmap Scripting Engine). This allows users to extend Ncrack's functionality, create custom authentication checks, parse non-standard responses, or integrate with other tools. Scripts can be loaded using the --script option, offering immense flexibility for advanced auditing scenarios.
HISTORY
Ncrack emerged as a component of the renowned Nmap security scanner project, spearheaded by Fyodor. Its development began around 2009, with the goal of creating a modern, high-performance network authentication cracking tool that could leverage Nmap's robust networking stack and extensive protocol support. Before Ncrack, Nmap primarily focused on port scanning and service detection; Ncrack extended its capabilities into the realm of credential auditing. It was designed to overcome some limitations of existing network crackers, offering better performance, modularity, and integration with the Nmap ecosystem, including its scriptable engine (NSE). Since its inception, Ncrack has become a valuable tool for penetration testers and security auditors to assess the strength of network service credentials.