ncrack

Overview

ncrack is a high-speed network authentication cracking tool from the nmap project. It’s designed for large-scale credential testing with a focus on reliability and speed. It supports a wide range of protocols and handles complex service interactions better than simpler tools like hydra.

Basic Usage

Crack SSH

ncrack -p ssh -U users.txt -P passwords.txt 10.10.10.1

Crack RDP

ncrack -p rdp -U users.txt -P passwords.txt 10.10.10.1

Crack FTP

ncrack -p ftp -U users.txt -P passwords.txt 10.10.10.1

Multiple services

ncrack -p ssh,ftp,rdp 10.10.10.1

Protocol Syntax

SSH

ncrack ssh://10.10.10.1 -U users.txt -P rockyou.txt

RDP (Remote Desktop)

ncrack rdp://10.10.10.1 -U users.txt -P rockyou.txt

FTP

ncrack ftp://10.10.10.1 -U users.txt -P rockyou.txt

HTTP Basic Auth

ncrack http://target.com -U users.txt -P rockyou.txt

HTTPS

ncrack https://target.com -U users.txt -P rockyou.txt

Telnet

ncrack telnet://10.10.10.1 -U users.txt -P rockyou.txt

VNC

ncrack vnc://10.10.10.1 -P rockyou.txt

SMB

ncrack smb://10.10.10.1 -U users.txt -P rockyou.txt

Speed and Concurrency

Set connection limit (default: 10)

ncrack -T4 ssh://10.10.10.1 -U users.txt -P rockyou.txt

Timing templates (1=paranoid to 5=insane)

ncrack -T5 rdp://10.10.10.1 -U users.txt -P rockyou.txt

Manual concurrency

ncrack --connection-limit 20 ssh://10.10.10.1 -U users.txt -P rockyou.txt

Pairwise mode (test each user with each password)

ncrack -pairwise ssh://10.10.10.1 -U users.txt -P rockyou.txt

Multiple Targets

Multiple IPs with same creds

ncrack -p ssh -U users.txt -P rockyou.txt 10.10.10.1 10.10.10.2 10.10.10.3

From a file

ncrack -p ssh -U users.txt -P rockyou.txt -iL targets.txt

Nmap format (host list)

ncrack -p ssh -U users.txt -P rockyou.txt --iL hosts.xml

Output

Verbose output

ncrack -v ssh://10.10.10.1 -U users.txt -P rockyou.txt

Save cracked credentials

ncrack ssh://10.10.10.1 -U users.txt -P rockyou.txt -oN results.txt

Resume an interrupted session

ncrack --resume ncrack-session.restore

Tips

• ncrack handles rate-limiting and lockouts better than hydra for complex services
• For RDP, lower concurrency to avoid triggering lockouts
• -T4 is a good balance of speed vs. stability for most targets
• Combine with impacket’s lookupsid.py first to discover valid usernames
• Use --user for single username, --pass for single password testing

ncrack [options] [target] [service://host:port]

-U FILE     Username list
-P FILE     Password list
-u USER     Single username
-p PASS     Single password (or protocol name)
-p PROTO    Protocol (ssh, rdp, ftp, http, etc.)
-T N        Timing (1-5, default: 3)
-v          Verbose
-iL FILE    Target list file
-oN FILE    Normal output file
--resume F  Resume from checkpoint file

Vue d’ensemble

ncrack est un outil de cassage d’authentification réseau haute vitesse du projet nmap. Il est conçu pour le test de credentials à grande échelle avec un accent sur la fiabilité et la vitesse. Il supporte un large éventail de protocoles et gère les interactions de services complexes mieux que des outils plus simples comme hydra.

Utilisation de base

# Casser SSH
ncrack -p ssh -U users.txt -P passwords.txt 10.10.10.1

# Casser RDP
ncrack -p rdp -U users.txt -P passwords.txt 10.10.10.1

# Casser FTP
ncrack -p ftp -U users.txt -P passwords.txt 10.10.10.1

# Plusieurs services
ncrack -p ssh,ftp,rdp 10.10.10.1

Syntaxe de protocole

# SSH
ncrack ssh://10.10.10.1 -U users.txt -P rockyou.txt

# RDP (Remote Desktop)
ncrack rdp://10.10.10.1 -U users.txt -P rockyou.txt

# FTP
ncrack ftp://10.10.10.1 -U users.txt -P rockyou.txt

# Authentification HTTP Basic
ncrack http://target.com -U users.txt -P rockyou.txt

# HTTPS
ncrack https://target.com -U users.txt -P rockyou.txt

# Telnet
ncrack telnet://10.10.10.1 -U users.txt -P rockyou.txt

# VNC
ncrack vnc://10.10.10.1 -P rockyou.txt

# SMB
ncrack smb://10.10.10.1 -U users.txt -P rockyou.txt

Vitesse et concurrence

# Définir la limite de connexions (défaut : 10)
ncrack -T4 ssh://10.10.10.1 -U users.txt -P rockyou.txt

# Templates de timing (1=paranoïaque à 5=insane)
ncrack -T5 rdp://10.10.10.1 -U users.txt -P rockyou.txt

# Concurrence manuelle
ncrack --connection-limit 20 ssh://10.10.10.1 -U users.txt -P rockyou.txt

# Mode pairwise (tester chaque utilisateur avec chaque mot de passe correspondant)
ncrack -pairwise ssh://10.10.10.1 -U users.txt -P rockyou.txt

Cibles multiples

# Plusieurs IPs avec les mêmes credentials
ncrack -p ssh -U users.txt -P rockyou.txt 10.10.10.1 10.10.10.2 10.10.10.3

# Depuis un fichier
ncrack -p ssh -U users.txt -P rockyou.txt -iL targets.txt

# Format nmap (liste d'hôtes)
ncrack -p ssh -U users.txt -P rockyou.txt --iL hosts.xml

Sortie

# Sortie verbeuse
ncrack -v ssh://10.10.10.1 -U users.txt -P rockyou.txt

# Sauvegarder les credentials cassés
ncrack ssh://10.10.10.1 -U users.txt -P rockyou.txt -oN results.txt

# Reprendre une session interrompue
ncrack --resume ncrack-session.restore

Conseils

• ncrack gère le rate-limiting et les lockouts mieux que hydra pour les services complexes
• Pour RDP, réduire la concurrence pour éviter de déclencher des lockouts
• -T4 est un bon équilibre vitesse/stabilité pour la plupart des cibles
• Combiner avec lookupsid.py d’impacket au préalable pour découvrir des noms d’utilisateur valides
• Utiliser --user pour un seul nom d’utilisateur, --pass pour tester un seul mot de passe

ncrack [options] [target] [service://host:port]

-U FILE     Username list
-P FILE     Password list
-u USER     Single username
-p PASS     Single password (or protocol name)
-p PROTO    Protocol (ssh, rdp, ftp, http, etc.)
-T N        Timing (1-5, default: 3)
-v          Verbose
-iL FILE    Target list file
-oN FILE    Normal output file
--resume F  Resume from checkpoint file