← retour aux outils back to tools

# ncrack

Casseur d'authentification réseau haute vitesse. Supporte SSH, RDP, FTP, Telnet, HTTP, HTTPS, SMB, POP3, IMAP, VNC, et plus : optimisé pour un parallélisme massif et un test de credentials rapide. High-speed network authentication cracker. Supports SSH, RDP, FTP, Telnet, HTTP, HTTPS, SMB, POP3, IMAP, VNC, and more — optimized for massive parallelism and fast credential testing.

↗ https://nmap.org/ncrack/

## Overview

ncrack is a high-speed network authentication cracking tool from the nmap project. It’s designed for large-scale credential testing with a focus on reliability and speed. It supports a wide range of protocols and handles complex service interactions better than simpler tools like hydra.

## Basic Usage

Crack SSH

    ncrack -p ssh -U users.txt -P passwords.txt 10.10.10.1

Crack RDP

    ncrack -p rdp -U users.txt -P passwords.txt 10.10.10.1

Crack FTP

    ncrack -p ftp -U users.txt -P passwords.txt 10.10.10.1

Multiple services

    ncrack -p ssh,ftp,rdp 10.10.10.1

## Protocol Syntax

SSH

    ncrack ssh://10.10.10.1 -U users.txt -P rockyou.txt

RDP (Remote Desktop)

    ncrack rdp://10.10.10.1 -U users.txt -P rockyou.txt

FTP

    ncrack ftp://10.10.10.1 -U users.txt -P rockyou.txt

HTTP Basic Auth

    ncrack http://target.com -U users.txt -P rockyou.txt

HTTPS

    ncrack https://target.com -U users.txt -P rockyou.txt

Telnet

    ncrack telnet://10.10.10.1 -U users.txt -P rockyou.txt

VNC

    ncrack vnc://10.10.10.1 -P rockyou.txt

SMB

    ncrack smb://10.10.10.1 -U users.txt -P rockyou.txt

## Speed and Concurrency

Set connection limit (default: 10)

    ncrack -T4 ssh://10.10.10.1 -U users.txt -P rockyou.txt

Timing templates (1=paranoid to 5=insane)

    ncrack -T5 rdp://10.10.10.1 -U users.txt -P rockyou.txt

Manual concurrency

    ncrack --connection-limit 20 ssh://10.10.10.1 -U users.txt -P rockyou.txt

Pairwise mode (test each user with each password)

    ncrack -pairwise ssh://10.10.10.1 -U users.txt -P rockyou.txt

## Multiple Targets

Multiple IPs with same creds

    ncrack -p ssh -U users.txt -P rockyou.txt 10.10.10.1 10.10.10.2 10.10.10.3

From a file

    ncrack -p ssh -U users.txt -P rockyou.txt -iL targets.txt

Nmap format (host list)

    ncrack -p ssh -U users.txt -P rockyou.txt --iL hosts.xml

## Output

Verbose output

    ncrack -v ssh://10.10.10.1 -U users.txt -P rockyou.txt

Save cracked credentials

    ncrack ssh://10.10.10.1 -U users.txt -P rockyou.txt -oN results.txt

Resume an interrupted session

    ncrack --resume ncrack-session.restore

## Tips

- ncrack handles rate-limiting and lockouts better than hydra for complex services
- For RDP, lower concurrency to avoid triggering lockouts
- `-T4` is a good balance of speed vs. stability for most targets
- Combine with impacket’s `lookupsid.py` first to discover valid usernames
- Use `--user` for single username, `--pass` for single password testing

Help / Man page

    ncrack [options] [target] [service://host:port]

    -U FILE     Username list
    -P FILE     Password list
    -u USER     Single username
    -p PASS     Single password (or protocol name)
    -p PROTO    Protocol (ssh, rdp, ftp, http, etc.)
    -T N        Timing (1-5, default: 3)
    -v          Verbose
    -iL FILE    Target list file
    -oN FILE    Normal output file
    --resume F  Resume from checkpoint file

## Vue d’ensemble

ncrack est un outil de cassage d’authentification réseau haute vitesse du projet nmap. Il est conçu pour le test de credentials à grande échelle avec un accent sur la fiabilité et la vitesse. Il supporte un large éventail de protocoles et gère les interactions de services complexes mieux que des outils plus simples comme hydra.

## Utilisation de base

    # Casser SSH
    ncrack -p ssh -U users.txt -P passwords.txt 10.10.10.1

    # Casser RDP
    ncrack -p rdp -U users.txt -P passwords.txt 10.10.10.1

    # Casser FTP
    ncrack -p ftp -U users.txt -P passwords.txt 10.10.10.1

    # Plusieurs services
    ncrack -p ssh,ftp,rdp 10.10.10.1

## Syntaxe de protocole

    # SSH
    ncrack ssh://10.10.10.1 -U users.txt -P rockyou.txt

    # RDP (Remote Desktop)
    ncrack rdp://10.10.10.1 -U users.txt -P rockyou.txt

    # FTP
    ncrack ftp://10.10.10.1 -U users.txt -P rockyou.txt

    # Authentification HTTP Basic
    ncrack http://target.com -U users.txt -P rockyou.txt

    # HTTPS
    ncrack https://target.com -U users.txt -P rockyou.txt

    # Telnet
    ncrack telnet://10.10.10.1 -U users.txt -P rockyou.txt

    # VNC
    ncrack vnc://10.10.10.1 -P rockyou.txt

    # SMB
    ncrack smb://10.10.10.1 -U users.txt -P rockyou.txt

## Vitesse et concurrence

    # Définir la limite de connexions (défaut : 10)
    ncrack -T4 ssh://10.10.10.1 -U users.txt -P rockyou.txt

    # Templates de timing (1=paranoïaque à 5=insane)
    ncrack -T5 rdp://10.10.10.1 -U users.txt -P rockyou.txt

    # Concurrence manuelle
    ncrack --connection-limit 20 ssh://10.10.10.1 -U users.txt -P rockyou.txt

    # Mode pairwise (tester chaque utilisateur avec chaque mot de passe correspondant)
    ncrack -pairwise ssh://10.10.10.1 -U users.txt -P rockyou.txt

## Cibles multiples

    # Plusieurs IPs avec les mêmes credentials
    ncrack -p ssh -U users.txt -P rockyou.txt 10.10.10.1 10.10.10.2 10.10.10.3

    # Depuis un fichier
    ncrack -p ssh -U users.txt -P rockyou.txt -iL targets.txt

    # Format nmap (liste d'hôtes)
    ncrack -p ssh -U users.txt -P rockyou.txt --iL hosts.xml

## Sortie

    # Sortie verbeuse
    ncrack -v ssh://10.10.10.1 -U users.txt -P rockyou.txt

    # Sauvegarder les credentials cassés
    ncrack ssh://10.10.10.1 -U users.txt -P rockyou.txt -oN results.txt

    # Reprendre une session interrompue
    ncrack --resume ncrack-session.restore

## Conseils

- ncrack gère le rate-limiting et les lockouts mieux que hydra pour les services complexes
- Pour RDP, réduire la concurrence pour éviter de déclencher des lockouts
- `-T4` est un bon équilibre vitesse/stabilité pour la plupart des cibles
- Combiner avec `lookupsid.py` d’impacket au préalable pour découvrir des noms d’utilisateur valides
- Utiliser `--user` pour un seul nom d’utilisateur, `--pass` pour tester un seul mot de passe

Aide / Page de manuel

    ncrack [options] [target] [service://host:port]

    -U FILE     Username list
    -P FILE     Password list
    -u USER     Single username
    -p PASS     Single password (or protocol name)
    -p PROTO    Protocol (ssh, rdp, ftp, http, etc.)
    -T N        Timing (1-5, default: 3)
    -v          Verbose
    -iL FILE    Target list file
    -oN FILE    Normal output file
    --resume F  Resume from checkpoint file