retour aux outils back to tools Ducklings

Medusa

Brute-forceur de connexion réseau parallélisé. Prend en charge SMB, SSH, FTP, HTTP, RDP, MySQL et plus de 20 protocoles. Conçu pour la vitesse grâce à une architecture modulaire. Parallelized network login brute-forcer. Supports SMB, SSH, FTP, HTTP, RDP, MySQL, and 20+ protocols. Designed for speed with modular architecture.

↗ http://foofus.net/goons/jmk/medusa/medusa.html

Overview

Medusa is a fast, parallel, modular brute-force tool for network services. Unlike Hydra, it was designed from the ground up for speed and stability on large-scale attacks. It supports 20+ protocols via plug-in modules.

Basic Usage

SSH brute-force

medusa -h 10.10.10.1 -u admin -P /usr/share/wordlists/rockyou.txt -M ssh

FTP

medusa -h 10.10.10.1 -u anonymous -p "" -M ftp

HTTP form login

medusa -h 10.10.10.1 -u admin -P wordlist.txt -M http -m FORM:/login.php:username=^USER^&password=^PASS^:Login failed

SMB

medusa -h 10.10.10.1 -u administrator -P wordlist.txt -M smbnt

Multiple hosts from file

medusa -H hosts.txt -u admin -P wordlist.txt -M ssh

Multiple usernames from file

medusa -h 10.10.10.1 -U users.txt -P wordlist.txt -M ssh

Username/password combos from file (user:pass format)

medusa -h 10.10.10.1 -C combo.txt -M ssh

Supported Protocols

medusa -d          # List available modules

# Common modules:
# ssh, ftp, http, https, smb / smbnt, rdp, telnet
# mysql, mssql, postgres, oracle
# smtp, pop3, imap
# vnc, snmp, ldap, cvs, svn

Parallelism & Speed

Number of parallel hosts

medusa -H hosts.txt -u admin -P wordlist.txt -M ssh -T 10

Parallel logins per host

medusa -h 10.10.10.1 -u admin -P wordlist.txt -M ssh -t 4

Retry failed attempts

medusa -h 10.10.10.1 -u admin -P wordlist.txt -M ssh -r 3

Timeout per connection (seconds)

medusa -h 10.10.10.1 -u admin -P wordlist.txt -M ssh -W 5

Output

Log found credentials

medusa -h 10.10.10.1 -U users.txt -P wordlist.txt -M ssh -O found.txt

Verbose output

medusa -h 10.10.10.1 -u admin -P wordlist.txt -M ssh -v 6

Suppress failed attempts

medusa -h 10.10.10.1 -u admin -P wordlist.txt -M ssh -v 4

RDP Brute-Force

medusa -h 10.10.10.1 -u administrator -P wordlist.txt -M rdp -t 1

→ Note: RDP is sensitive to parallel connections — keep -t low

Tips

Use -t 1 for protocols that throttle or lock out on parallel attempts (RDP, WinRM)
medusa -d lists module names; medusa -M ssh -q shows module-specific options
Prefer Hydra for wider protocol support; Medusa for parallelized SMB/SSH testing
Always check password policy before brute-forcing AD accounts to avoid lockouts

Help / Man page

medusa [options]

Target:
  -h host         Single target host
  -H file         File of hosts
  -u user         Single username
  -U file         File of usernames
  -p pass         Single password
  -P file         File of passwords
  -C file         File of user:pass combos

Module:
  -M module       Module to use (e.g. ssh, ftp)
  -m options      Module-specific options
  -d              List available modules
  -q              Display module options

Performance:
  -t N            Parallel logins per host (default: 4)
  -T N            Parallel hosts (default: 1)
  -L              Stop after first valid login per host

Output:
  -O file         Output file for successful logins
  -v level        Verbosity (0-6, default: 5)
  -w N            Wait N seconds between retries
  -r N            Retry N times on socket error
  -W N            Timeout per connection (seconds)

Vue d’ensemble

Medusa est un outil de brute-force rapide, parallèle et modulaire pour les services réseau. Contrairement à Hydra, il a été conçu dès le départ pour la vitesse et la stabilité sur des attaques à grande échelle. Il prend en charge plus de 20 protocoles via des modules externes.

Utilisation de base

# Brute-force SSH
medusa -h 10.10.10.1 -u admin -P /usr/share/wordlists/rockyou.txt -M ssh

# FTP
medusa -h 10.10.10.1 -u anonymous -p "" -M ftp

# Connexion via formulaire HTTP
medusa -h 10.10.10.1 -u admin -P wordlist.txt -M http -m FORM:/login.php:username=^USER^&password=^PASS^:Login failed

# SMB
medusa -h 10.10.10.1 -u administrator -P wordlist.txt -M smbnt

# Plusieurs hôtes depuis un fichier
medusa -H hosts.txt -u admin -P wordlist.txt -M ssh

# Plusieurs noms d'utilisateur depuis un fichier
medusa -h 10.10.10.1 -U users.txt -P wordlist.txt -M ssh

# Combinaisons utilisateur/mot de passe depuis un fichier (format user:pass)
medusa -h 10.10.10.1 -C combo.txt -M ssh

Protocoles pris en charge

medusa -d          # Lister les modules disponibles

# Modules courants :
# ssh, ftp, http, https, smb / smbnt, rdp, telnet
# mysql, mssql, postgres, oracle
# smtp, pop3, imap
# vnc, snmp, ldap, cvs, svn

Parallélisme et vitesse

# Nombre d'hôtes en parallèle
medusa -H hosts.txt -u admin -P wordlist.txt -M ssh -T 10

# Connexions en parallèle par hôte
medusa -h 10.10.10.1 -u admin -P wordlist.txt -M ssh -t 4

# Réessayer les tentatives échouées
medusa -h 10.10.10.1 -u admin -P wordlist.txt -M ssh -r 3

# Délai d'expiration par connexion (secondes)
medusa -h 10.10.10.1 -u admin -P wordlist.txt -M ssh -W 5

Sortie

# Journaliser les identifiants trouvés
medusa -h 10.10.10.1 -U users.txt -P wordlist.txt -M ssh -O found.txt

# Sortie verbeuse
medusa -h 10.10.10.1 -u admin -P wordlist.txt -M ssh -v 6

# Supprimer les tentatives échouées
medusa -h 10.10.10.1 -u admin -P wordlist.txt -M ssh -v 4

Brute-force RDP

medusa -h 10.10.10.1 -u administrator -P wordlist.txt -M rdp -t 1

→ Remarque : RDP est sensible aux connexions parallèles, garder -t faible

Conseils

Utiliser -t 1 pour les protocoles qui limitent ou bloquent après des tentatives parallèles (RDP, WinRM)
medusa -d liste les noms de modules ; medusa -M ssh -q affiche les options spécifiques au module
Préférer Hydra pour une prise en charge plus large des protocoles ; Medusa pour les tests parallélisés SMB/SSH
Toujours vérifier la politique de mots de passe avant de brute-forcer des comptes AD pour éviter les verrouillages

Aide / Page de manuel

medusa [options]

Target:
  -h host         Single target host
  -H file         File of hosts
  -u user         Single username
  -U file         File of usernames
  -p pass         Single password
  -P file         File of passwords
  -C file         File of user:pass combos

Module:
  -M module       Module to use (e.g. ssh, ftp)
  -m options      Module-specific options
  -d              List available modules
  -q              Display module options

Performance:
  -t N            Parallel logins per host (default: 4)
  -T N            Parallel hosts (default: 1)
  -L              Stop after first valid login per host

Output:
  -O file         Output file for successful logins
  -v level        Verbosity (0-6, default: 5)
  -w N            Wait N seconds between retries
  -r N            Retry N times on socket error
  -W N            Timeout per connection (seconds)