Ncrack Reference Guide (Man Page)

-iX <inputfilename> (Input from Nmap's -oX XML output format)

Reads target/service specifications from an Nmap XML output file. The Nmap XML file is created by scanning any hosts and specifying the Nmap -oX option. Ncrack will automatically parse the IP addresses and the corresponding ports and services that are open and will use these targets for authentication auditing. This is a really useful option, since it lets you essentially combine these two tools -Nmap and Ncrack- for cracking only those services that are surely open. In addition, if version detection has been enabled in Nmap (-sV option), Ncrack will use those findings to recognize and crack those services that are supported but are listening on non-default ports. For example, if a host is having a server listening on port 41414 and Nmap has identified that it is a SSH service, Ncrack will use that information to crack it using the SSH module. Of course, Ncrack is going to ignore open ports/services that are not supported for authentication cracking by its modules.

-iN <inputfilename> (Input from Nmap's -oN Normal output format)

Reads target/service specifications from an Nmap Normal output file. The Nmap Normal file is created by scanning any hosts and specifying the Nmap -oN option. This works exactly like Ncrack's -iX option, the only difference being the format of the input file.

-iL <inputfilename> (Input from list)

Reads target specifications from <inputfilename>. Passing a huge list of hosts is often awkward on the command line, yet it is a common desire. For example, you might want to crack a list of very specific servers that have been specified for penetration testing. Simply generate the list of hosts to crack and pass that filename to Ncrack as an argument to the -iL option. Entries can be in any of the formats accepted by Ncrack on the command line (IP address, hostname, CIDR, octet ranges or Ncrack's special host-service syntax. Each entry must be separated by one or more spaces, tabs, or newlines. You can specify a hyphen (-) as the filename if you want Ncrack to read hosts from standard input rather than an actual file. Note, however, that if hosts are specified without any service, you will have to also provide services/ports for the targets using the -p option.

--exclude <host1>[, <host2>[, ...]] (Exclude hosts/networks)

Specifies a comma-separated list of targets to be excluded from the scan even if they are part of the overall network range you specify. The list you pass in uses normal Ncrack syntax, so it can include hostnames, CIDR netblocks, octet ranges, etc. This can be useful when the network you wish to scan includes untouchable mission-critical servers, systems that are known to react adversely to heavy load, or subnets administered by other people.

--excludefile <exclude_file> (Exclude list from file)

This offers the same functionality as the --exclude option, except that the excluded targets are provided in a newline, space, or tab delimited <exclude_file> rather than on the command line.

Services specified in this mode are written next to the host and apply to it only. Keep in mind, however, that target-specification allows wildcards/netmasks, which essentially means that applying a per-host service specification format to that particular target will affect all of the expanded ones as a result. The general format is:

<[service-name]>://<target>:<[port-number]>

where <target> is a hostname or IP address in any of the formats described in the target-specification section, <[service-name]> is one of the common service names as defined in the ncrack-services file (e.g ssh, http) and <[port-number]> is what it obviously means. Ncrack can determine the default port numbers for each of the services it supports, as well as being able to deduce the service name when a default port number has been specified. Specifying both has meaning only when the user has a priori knowledge of a service listening on a non-default port number. This can easily be determined by using version detection like the one offered by Nmap's -sV option.

Example 2. Per-host service specification example

$ ncrack scanme.nmap.org:22 ftp://10.0.0.10 ssh://192.168.1.*:5910

       

The above command will try to crack hosts: scanme.nmap.org on SSH service (default port 22), 10.0.0.10 on FTP service (default port 21) and 192.168.1.0 - 192.168.1.255 (all of this C subnet) on SSH service on non-default port 5910 which has been explicitly specified. In the last case, Ncrack wouldn't be able to determine that the subnet hosts are to be scanned against the SSH service on that particular port without the user explicitly asking for it, because there isn't any mapping of port-number 5910 to service SSH.

Services specified in this mode are applied to all hosts that haven't been associated with the per-host service specification format. This is done using the -p option. While this facility may be similar to that of Nmap's, you should try not to confuse it, since the functionality is of a slightly different nature. Services can be specified using comma separated directives of the general format:

-p <[service1]>:<[port-number1]>,<[service2]>:<[port-number2]>,...

As usual, you need not specify both service name and port number since Ncrack knows the mappings of default-services to default-port numbers. Be careful though not to include any space between each service-name and/or port number, because Ncrack will think that the argument after the space is a host as per the rule "everything that isn't an option is a target specification".

Example 3. Global service specification example

$ ncrack scanme.nmap.org 10.0.0.120-122 192.168.2.0/24 -p 22,ftp:3210,telnet

       

The above command will try to crack all of the specified hosts scanme.nmap.org, 10.0.0.120, 10.0.0.121, 10.0.0.122 and the C class subnet of 192.168.2.0 against the following services: SSH service (mapped from default port 22), FTP service on non-default port 3210, and TELNET service on default port 23.

Options in this mode apply only to the host(s) they are referring to and are written next to it according to the following format:

<[service-name]>://<target>:<[port-number]>,<opt1>=<optval1>,<opt2>=<optval>,...

The format concerning the service specification which comes before the options, has been explained in the previous section. <optN> is referring to any of the option names that are available (a list will follow below), while optvalN determines the value of that option and depends on the nature of it. For example, most timing-related options expect to receive numbers as values, while the path option obviously needs a string argument.

Options in this mode apply to all hosts that are associated with the particular service/module. This is accomplished using the -m which is defined with the format:

-m <service-name>:<opt1>=<optval1>,<opt2>=<optval2>,...

This option can be invoked multiple times, for as many different services as you might need to define service-wide applicable options. Each iteration of this option must refer to only one service. However, to avoid confusion, this option had better not be called more than one time for the same service, although this is allowed and the last iteration will take precedence over the previous ones for all redefined option values.

Options in this mode apply to all hosts regardless of which service they are associated with. This is accomplished using the -g as follows:

-g <opt1>=<optval1>,<opt2>=<optval2>,...

This acts as a convenience option, where you can apply options to all services globally. Everything else regarding the available options and option values is the same as the previous modes.

Below follows a list of all the currently available service options. You can apply them with any of the three modes described above. The last six of the options are timing related and will be analyzed in Section "Timing and Performance" of this manual.

ssl: enable SSL over this service
path: path-name used in modules like HTTP ('=' needs escaping if used)
db: used in modules like MongoDB to specify the database
domain: used in modules like WinRM to specify the domain
cl (min connection limit): minimum number of concurrent parallel connections
CL (max connection limit): maximum number of concurrent parallel connections
at (authentication tries): authentication attempts per connection
cd (connection delay): delay time between each connection initiation
cr (connection retries): caps number of service connection attempts
to (time-out): maximum cracking time for service, regardless of success so far
    

ssl (Enable/Disable SSL over service)

By enabling SSL, Ncrack will try to open a TCP connection and then negotiate a SSL session with the target. Everything will then be transparently encrypted and decrypted. However, since Ncrack's job is to provide speed rather than strong crypto, the algorithms and ciphers for SSL are chosen on an efficiency basis. Possible values for this option are 'yes' but just specifying ssl would be enough. Thus, this is the only option that doesn't need to be written in the <opt>=<optval> format. By default, SSL is disabled for all services except those that are stricly dependent on it like HTTPS.

path <name> (Path name for relative URLs)

Some services like HTTP or SVN usually require a specific path in the URL. This option takes that pathname string as its value. The path is always relative to the hostname or IP address, so if you want to target something like http://foobar.com/login.php the path must take the value path=login.php . The initial '/' is added if you omit it. However, it is usually better if you explicitly specify it at the end of pathnames that are directories. For example, to crack the directory for http://foobar.com/protected-dir/ , it would be better if you wrote it as path=protected-dir/ . This is to avoid the (very) slight probability of a false positive, because there are cases where Web servers might reply with a "301 Moved Permanently" for a non-successful attempt. They normally send that reply, when a successful attempt is made for a requested password-protected path which has omitted the ending '/' but the requested source is actually a directory. Consequently, Ncrack regards that reply as having succeeded in the authentication attempt.

Also be careful with the symbol '=', since it is used by Ncrack for argument parsing and you will have to espace it if it is included in the URL.

By default, the path-name is initialized to '/', but will be ignored by services that do not require it.

db <name> (Database name)

Some services like MongoDB require a specific database name to crack. This option allows you to specify the database.

By default, the db name for MongoDB is initialized to 'admin' but will be ignored by services that do not require it.

domain <name> (Domain name)

Some services like WinRM require a specific domain to crack. This option allows you to specify the domain.

By default, the domain name for WinRM is initialized to 'Workstation' but will be ignored by services that do not require it.

As already noted, Ncrack allows a combination of the three different modes of service option specification. In that case, there is a strict hierarchy that resolves the order in which conflicting values for these options take precedence over each other. The order is as follows, leftmost being the highest priority and rightmost the lowest one:

Per-host options > Per-module options > Global options > Timing-Template (for timing options only)

The concept of the "Timing-Template" will be explained in the Section "Timing and Performance", but for now, just have in mind that its values have the least prevalence over everything else and essentially act as defaults for everything timing-related. Global options specified with -g have the directly higher precedence, while -m per-module options are immediately higher. In the top of the hierarcy reside the per-host options which are essentially the most specific ones. Consequently, you can see that the pattern is: the more specific the higher the precedence.

$ ncrack scanme.nmap.org:22,cl=10,at=1 10.0.0.120 10.0.0.20 -p 21 -m ftp:CL=1 -g CL=3

       

The example demonstrates the hierarchy precedence. The services that are going to be cracked are SSH for scanme.nmap.org and FTP for hosts 10.0.0.120, 10.0.0.20. No particular timing-template has been specified and thus the default will be used (Normal - 3). The per-host options for scanme.nmap.org define that the minimum connection limit (cl) is 10 and that Ncrack should attempt only 1 authentication try (at) per connection. These values would override any other for service SSH of host scanme.nmap.org if there were conflicts with other modes. Since a global option of -g CL=3 was defined and there is no other higher-precedence for service SSH and scanme.nmap.org in particular, this value will also be applied. As for the FTP targets, the per-module -m ftp:CL=1 defined for all FTP services will override the equivalent global one. All these can get quite complex if overused, but they are not expected to be leveraged by the average Ncrack user anyway. Complicated network scanning scenarios might require them, though. To make certain the results are the ones you expect them to be, don't forget to use the -sL option that prints out details about what Ncrack would crack if invoked normally. You can add the debugging -d option if you want even more verbose output. For the above example, Ncrack would print the following:

$ ncrack scanme.nmap.org:22,cl=10,at=1 10.0.0.120 10.0.0.20 -p 21 -m ftp:CL=1 -g CL=3 -sL -d

Starting Ncrack 0.8 ( http://ncrack.org ) at 2017-10-12 01:13 CDT

----- [ Timing Template ] -----
cl=7, CL=80, at=0, cd=0, cr=30, to=0

----- [ ServicesTable ] -----
SERVICE            cl  CL  at  cd  cr  to  ssl path db    domain
ftp:21             N/A 1   N/A N/A N/A N/A no  null null  null
ssh:22             N/A N/A N/A N/A N/A N/A no  null null  null
telnet:23          N/A N/A N/A N/A N/A N/A no  null null  null
http:80            N/A N/A N/A N/A N/A N/A no  null null  null
pop3:110           N/A N/A N/A N/A N/A N/A no  null null  null
imap:143           N/A N/A N/A N/A N/A N/A no  null null  null
netbios-ssn:445    N/A N/A N/A N/A N/A N/A no  null null  null
smb:445            N/A N/A N/A N/A N/A N/A no  null null  null
smb:139            N/A N/A N/A N/A N/A N/A no  null null  null
https:443          N/A N/A N/A N/A N/A N/A yes null null  null
owa:443            N/A N/A N/A N/A N/A N/A yes null null  null
sip:5060           N/A N/A N/A N/A N/A N/A no  null null  null
pop3s:995          N/A N/A N/A N/A N/A N/A yes null null  null
mssql:1433         N/A N/A N/A N/A N/A N/A no  null null  null
mysql:3306         N/A N/A N/A N/A N/A N/A no  null null  null
ms-wbt-server:3389 N/A N/A N/A N/A N/A N/A no  null null  null
rdp:3389           N/A N/A N/A N/A N/A N/A no  null null  null
psql:5432          N/A N/A N/A N/A N/A N/A no  null null  null
vnc:5801           N/A N/A N/A N/A N/A N/A no  null null  null
vnc:5900           N/A N/A N/A N/A N/A N/A no  null null  null
vnc:5901           N/A N/A N/A N/A N/A N/A no  null null  null
vnc:6001           N/A N/A N/A N/A N/A N/A no  null null  null
redis:6379         N/A N/A N/A N/A N/A N/A no  null null  null
winrm:5985         N/A N/A N/A N/A N/A N/A no  null null  Workstation
winrm:5986         N/A N/A N/A N/A N/A N/A no  null null  Workstation
cassandra:9160     N/A N/A N/A N/A N/A N/A no  null null  null
cassandra:9042     N/A N/A N/A N/A N/A N/A no  null null  null
mongodb:27017      N/A N/A N/A N/A N/A N/A no  null admin null

----- [ Targets ] -----
Host: 45.33.32.156 ( scanme.nmap.org ) 
  ssh:22 cl=10, CL=10, at=1, cd=0, cr=30, to=0ms, ssl=no, path=/, db=admin, domain=Workstation
Host: 10.0.0.120
  ftp:21 cl=3, CL=1, at=0, cd=0, cr=30, to=0ms, ssl=no, path=/, db=admin, domain=Workstation
Host: 10.0.0.20
  ftp:21 cl=3, CL=1, at=0, cd=0, cr=30, to=0ms, ssl=no, path=/, db=admin, domain=Workstation


Ncrack done: 3 services would be scanned.
Probes sent: 0 | timed-out: 0 | prematurely-closed: 0

Ncrack finished.


       

The ServicesTable just lists the per-module options for all available services. As you can see, the only defined option is in the FTP service for the CL . The Targets table is the most important part of this output and lists all targets and associated options according to the command-line invocation. No network operation takes place in this mode, apart from forward DNS resolution for hostnames (like scanme.nmap.org in this example).

cl <num-minconnections>; CL <num-maxconnections> (Adjust number of concurrent parallel connections)

Connection Limit

These options control the total number of connections that may be outstanding for any service at the same time. Normally, Ncrack tries to dynamically adjust the number of connections for each individual target by counting how many drops or connection failures happen. If a strange network condition occurs, that signifies that something may be going wrong, like the host dropping any new connection attempts, then Ncrack will immediately lower the total number of connections hitting the service. However, the caps number of the minimum or maximum connections that will take place can be overriden using these two options. By properly adjusting them, you can essentially optimize performance, if you can handle the tricky part of knowing or discovering your target's own limits. The convention here is that cl with lowercase letters is referring to the minimum connection limit, while CL with uppercase letters is referring to the maximum number of connections.

The most common usage is to set cl (minimum connection limit) for targets that you are almost certain are going to withstand these many connections at any given time. This is a risky option to play with, as setting it too high might actually do more harm than good by effectively DoS-attacking the target and triggering firewall rules that will ban your IP address.

On the other hand, for more stealthy missions, setting the CL (maximum connection limit) to a low value might be what you want. However, setting it too low will surely have a great impact in overall cracking speed. For maximum stealth, this can be combined with the cd (connection delay) described below.

at <num-attempts> (Adjust authentication attempts per connection)

Authentication Tries

Using this option, you can order Ncrack to limit the authentication attempts it carries out per connection. Ncrack initially sends a reconnaisance probe that lets it calculate the maximum number of such authentication tries and from thereon it always tries to use that number. Most servicse pose an upper limit on the number of authentication per connection and in most cases finding that maximum leads to better performance.

Setting this option to lower values can give you some stealth bonus, since services such as SSH tend to log failed attempts after more than a certain number of authentication tries per connection. They use that as a metric rather than counting the total number of authentication attempts or connections per IP address (which is usually done by a firewall). Consequently, a number of 1 or 2 authentication tries might circumvent logging in some cases.

Note that setting that option to a high value will not have any effect if Ncrack realizes that the server doesn't allow that many attempts per connection. In this case, it will just use that maximum number and ignore your setting.

cd <time> (Adjust delay time between each new connection)

Connection Delay

This option essentially defines the imposed time delay between each new connection. Ncrack will wait the amount of time you specify in this option value, before starting a new connection against the given service. The higher you set it, the slower Ncrack will perform, but the stealthier your attack will become.

Ncrack by default tries to initiate new connections as fast as possible given that new probes are actually allowed to be sent and are not restricted by parameters such as Connection Limit which can dynamically increase or decrease. Although this approach achieves blazing speed as long as the host remains responsive, it can lead to a number of disasters such as a firewall being triggered, the targets' or your bandwidth to be diminished and even the tested service to suffer a Denial of Service attack. By carefully adjusting this option, you can potentially avoid these annoying situations.

cr <max-conattempts> (Adjust the max number of connection retries)

Connection Retries

This option allows the user to specify the maximum amount of consecutive failed attempts against that particular service. If at any time, during the cracking session, Ncrack fails to connect against that particular service, then it will stop cracking it entirely.

to <time> (Adjust the maximum overall cracking time)

Timeout

Define how much time Ncrack is going to spend cracking the service, before giving up regardless of whether it has found any credentials so far. However, any authentication token discovered until that time, will be stored and printed normally. Ncrack marks a service as finished when the username/password lists iteration ends or when it can no longer crack it for some serious reason. If Ncrack finishes cracking a service before the time specified in this option, then it will not be taken into account at all.

Sometimes, you have a limited time window to scan/crack your hosts. This might occur for various reasons. A common one would be that normal user activity mustn't be interrupted and since Ncrack can become very aggressive, it might be allowed to scan the hosts only at during certain time period like the night hours. Scanning during certain such hours is also likely to make an attack less detectable.

Don't forget that Ncrack allows you to specify the time unit of measure by appending ‘ms’, ‘m’, or ‘h’ for milliseconds, minutes or hours (seconds is the default time unit). Using them in this particular option, is really convenient as you can specify something like to=8h to give Ncrack a total of 8 hours to crack that service. Setting up cronjobs for scheduled scans in combination with this option, might also be a good idea.

-T paranoid|sneaky|polite|normal|aggressive|insane (Set a timing template)

While the fine-grained timing controls discussed in the previous section are powerful and effective, some people find them confusing. Moreover, choosing the appropriate values can sometimes take more time than the scan you are trying to optimize. So Ncrack offers a simpler approach, with six timing templates. You can specify them with the -T option and their number (0–5) or their name. The template names are paranoid (0), sneaky (1), polite (2), normal (3), aggressive (4), and insane (5). The first two are for IDS evasion. Polite mode slows down the scan to use less bandwidth and target machine resources. Normal mode is the default and so -T3 does nothing. Aggressive mode speeds scans up by making the assumption that you are on a reasonably fast and reliable network. Finally insane mode assumes that you are on an extraordinarily fast network or are willing to sacrifice some accuracy for speed.

These templates allow the user to specify how aggressive they wish to be, while leaving Ncrack to pick the exact timing values. If you know that the network service is going to withstand a huge number of connections you might try using the aggressive template of -T4 . Even then, this is mostly advised for services residing in the local network. Going over to insane mode -T5 is not recommended, unless you absolutely know what you are doing.

While -T0 and -T1 may be useful for avoiding IDS alerts, they will take an extraordinarily long time to crack even a few services. For such a long scan, you may prefer to set the exact timing values you need rather than rely on the canned -T0 and -T1 values.

--connection-limit <numprobes> (Adjust the threshold of total concurrent connections)

NOT IMPLEMENTED YET.

-U <filename> (Specify username list)

Specify your own username list by giving the path to the filename as argument to this option.

Usernames for specific environments can be gathered in numerous ways including harvesting for email-addresses in the company's website, looking up information in whois databases, using the SMTP VRFY technique at vulnerable mail servers or through social engineering.

-P <filename> (Specify password list)

Specify your own password list by giving the path to the filename as argument to this option.

Common passwords are usually derived from leaked lists as a result of successful intrusions in public sites such as forums or other social networking places. A great deal of them have already been publicly disclosed and some of these have been used to assemble Ncrack's own lists.

--user <username_list> (Specify command-line comma-separated username list)

Specify your own usernames directly in the command-line as a comma-separated list.

--pass <password_list> (Specify command-line comma-separated password list)

Specify your own passwords directly in the command-line as a comma-separated list.

--passwords-first (Reverse the way passwords are iterated)

Ncrack by default iterates the username list for each password. With this option, you can reverse that. For example, given the username list of -> "root, guest, admin" and the password list of "test, 12345, q1w2e3r4" Ncrack will normally go over them like this -> root:test, guest:test, admin:test, root:12345 etc. By enabling this option it will go over them like this -> root:test, root:12345, root:q1w2e3r4, guest:test etc.

Most network authentication cracking tools prefer by default to iterate the password list for each username. This is, however, ineffective compared to the opposite iteration in most cases. This holds true for the simple reason that password lists are usually sorted on a frequency basis, meaning that the more common a password is, the closer to the beginning of the password list it is. Thus, iterating over all usernames for the most common passwords first has usually more chances to get a positive result. With the --passwords-first iteration, very common passwords might not even be tried out for certain usernames if the user chooses to abort the session early. However, this option might prove valuable for cases where the attacker knows and has already verified that the username list contains real usernames, instead of blindly bruteforcing through them.

--pairwise (Choose usernames and passwords in pairs)

Enabling this option will make Ncrack iterate the username and password list by choosing them in pairs. For example, given the username list of "root, guest, admin" and the password list of "test, 12345, q1w2e3r4" Ncrack will go over them like this: "root:test", "guest:12345", "admin:q1w2e3r4". This is particulary useful when inside knowledge of the infrastructure tested is available and special username and password lists have been made.

-oN <filespec> (normal output)

Requests that normal output be directed to the given filename. As discussed above, this differs slightly from interactive output.

-oX <filespec> (XML output)

Requests that XML output be directed to the given filename.

-oA <basename> (Output to all formats)

As a convenience, you may specify -oA <basename> to store scan results in normal and XML formats at once. They are stored in <basename>.ncrack, and <basename>.xml respectively. As with most programs, you can prefix the filenames with a directory path, such as ~/ncracklogs/foocorp/ on Unix or c:\hacking\sco on Windows.

-v (Increase verbosity level)

Increases the verbosity level, causing Ncrack to print more information about the scan in progress. Credentials are shown as they are found and more statistical information is printed in the end. Use it twice or more for even greater verbosity.

-d [level] (Increase or set debugging level)

When even verbose mode doesn't provide sufficient data for you, debugging is available to flood you with much more! As with the verbosity option (-v), debugging is enabled with a command-line flag (-d) and the debug level can be increased by specifying it multiple times. Alternatively, you can set a debug level by giving an argument to -d. For example, -d10 sets level ten. That is the highest effective level and will produce thousands of lines, unless your cracking session is going really slow.

Debugging output is useful when a bug is suspected in Ncrack, or if you are simply confused as to what Ncrack is doing and why. As this feature is mostly intended for developers, debug lines aren't always self-explanatory. If you don't understand a line, your only recourses are to ignore it, look it up in the source code, or request help from the development list (nmap-dev). Some lines are self explanatory, but the messages become more obscure as the debug level is increased.

--nsock-trace <level> (Set nsock trace level)

This option is meant mostly for developers as enabling it will activate the Nsock's library debugging output. Nsock is the underlying library for parallel socket handling. You will have to specify a certain level for this option. Valid range is 0 up to 10. Usually, a level of 1 or 2 is enough to get a good overview of network operations happening behind the scenes. Nsock prints that information to stdout by default.

--log-errors (Log errors/warnings to normal mode output file)

Warnings and errors printed by Ncrack usually go only to the screen (interactive output), leaving any normal-format output files (usually specified with -oN) uncluttered. When you do want to see those messages in the normal output file you specified, add this option. It is useful when you aren't watching the interactive output or when you want to record errors while debugging a problem. The error and warning messages will still appear in interactive mode too. This won't work for most errors related to bad command-line arguments because Ncrack may not have initialized its output files yet.

An alternative to --log-errors is redirecting interactive output (including the standard error stream) to a file. Most Unix shells make this approach easy, though it can be difficult on Windows.

--append-output (Append to rather than clobber output files)

When you specify a filename to an output format flag such as -oX or -oN, that file is overwritten by default. If you prefer to keep the existing content of the file and append the new results, specify the --append-output option. All output filenames specified in that Ncrack execution will then be appended to rather than clobbered. This doesn't work well for XML (-oX) scan data as the resultant file generally won't parse properly until you fix it up by hand.

--resume <file> (Continue previously saved session)

Whenever the user cancels a running session (usually by pressing Ctrl C), Ncrack saves the current state into a file which it can later use to continue from where it had stopped. This file is saved in subdirectory .ncrack/ of the user's home path with a filename format of "restore.YY-MM-DD_hh-mm". An example would be: "/home/ithilgore/.ncrack/restore.2010-05-18_04-42 ". You can then continue your session, by specifying this file as argument to the --resume option.

-f (Quit cracking service after one found credential)

This option will force Ncrack to quit cracking a service as soon as it finds a valid username/password combination for it. Assuming many parallel services are being cracked at the same time, this option is applied on each of them separately. This means that Ncrack will stop cracking each individual service after finding a pair of credentials for it, but will not quit entirely. Supplying the option two times, like -f -f will, however, make Ncrack exit immediately as soon as it finds a valid credential for any service.

Frequently, attackers will try cracking several services in parallel to maximize the chances of finding a pair of valid credentials. Given that a network is no stronger than its weakest link, this option and especially the -f -f counterpart will often be used to lessen chances of detection and prevent network resources from being wasted aimlessly.

-6 (Enable IPv6 scanning)

Warning: This option was just added and it is currently experimental, so please notify us for any problems and bugs related to it.

The command syntax is the same as usual except that you also add the -6 option. Of course, you must use IPv6 syntax if you specify an address rather than a hostname. An address might look like 3ffe:7501:4819:2000:210:f3ff:fe03:14d0, so hostnames are recommended. The output looks the same as usual, with the IPv6 address on the “Discovered credentials” line being the only IPv6 give away.

While IPv6 hasn't exactly taken the world by storm, it gets significant use in some (usually Asian) countries and most modern operating systems support it. To use Ncrack with IPv6, both the source and target of your scan must be configured for IPv6. If your ISP (like most of them) does not allocate IPv6 addresses to you, free tunnel brokers are widely available and will probably work fine with Ncrack. A popular IPv6 tunnel broker service is at http://www.tunnelbroker.net. 6to4 tunnels are another popular, free approach.

-sL (List Scan)

The list scan simply lists each host and service that would be cracked if this option wasn't specified. No packets are sent to the target hosts and the only network operation that might happen is DNS-resolution of any hostnames of targets. This option is really helpful in making sure that you have specified everything as you wanted. Service-specific options will also be printed so this acts as a good sanity check of potentially complex command-line arguments such as the advanced modes of Service Option Specification and the equivalent Hierarchy for sessions that require delicate timing handling. If list scan is called along with the -d debug option, then additional output, like the ServicesTable and the current Timing-Template's parameters, is also going to be printed.

--datadir <directoryname> (Specify custom Ncrack data file location)

Ncrack needs a file called ncrack-services to load a lookup-table of supported services/ports. This file shouldn't be changed, unless you know what you are doing (e.g extending Ncrack for additional modules). In addition, Ncrack is shipped with various username and password lists, some of which are used by default in case the user doesn't specify ones of his own. All these files are normally copied during the installation procedure to a directory such as /usr/share/ncrack or /usr/local/share/ncrack . Using the --datadir option, will force Ncrack to start searching for these files in specified directory. If the files aren't found, then it will continue searching in the directory specified by the NCRACKDIR environmental variable NCRACKDIR (if it is defined). Next comes ~/.ncrack directory for real and effective UIDs (POSIX systems only) or location of the Ncrack executable (Win32 only), and then a compiled-in location such as /usr/local/share/ncrack or /usr/share/ncrack. As a last resort, Ncrack will look in the current directory.

--proxy <type>://<proxy>:<port> (Make connections via socks4, 4a, http)

This will make Ncrack perform the authentication cracking session through the proxy host specified.

-V; --version (Print version number)

Prints the Ncrack version number and exits.

-h; --help (Print help summary page)

Prints a short help screen with the most common command flags. Running Ncrack without any arguments does the same thing.

v / V

Increase / decrease the verbosity level

d / D

Increase / decrease the debugging Level

p / P

Display found credentials

?

Print a runtime interaction help screen

Anything else

Print out a status message like this:

Stats: 0:00:20 elapsed; 0 services completed (1 total)

Rate: 6.26; Found: 1; About 13.27% done; ETC: 21:06 (0:02:17 remaining)

FTP authentication is quite fast, since there is very little protocol negotiation overhead. Most FTP daemons allow 3 to 6 authentication attempts but usually impose a certain delay before replying with the results of a failed attempt. Filezilla is one of the most characteristic examples of this case, where the time delay is so great, that it is usually faster to open more connections against it, with each of them doing only 1 authentication per connection.

Telnet daemons have been largely substituded by their safer 'counterpart' of SSH. However, there are many boxes, mainly routers or printers, that still rely on Telnet for remote access. Usually these are also easier to crack, since default passwords for them are publicly known. The drawback is that telnet is a rather slow protocol, so you shouldn't be expecting really high rates against it.

SSH is one of the most prevalent protocols in today's networks. For this reason, a special library, named opensshlib and based on code from OpenSSH, was specifically built and tailored for Ncrack's needs. Opensshlib ships in with Ncrack, so SSH support comes out of the box. OpenSSL will have to be installed in Unix systems though. Windows OpenSSL dlls are included in Ncrack, so Windows users shouldn't be worrying about it at all.

SSH bruteforcing holds many pitfalls and challenges, and you are well advised to read a paper that was written to explain them. The latest version of the "Hacking the OpenSSH library for Ncrack" document can be found under docs/openssh_library.txt or at http://sock-raw.org/papers/openssh_library

The HTTP Module currently supports basic and digest authentication. Ncrack tries to use the "Keepalive" HTTP option, whenever possible, which leads to really high speeds, since that allows dozens of attempts to be carried out per connection. The HTTP module can also be called over SSL.

The SMB module currently works over raw TCP. NetBIOS isn't supported yet. This protocol allows for high parallelization, so users could potentially increase the number of concurrent probes against it. SMB is frequently used for file-sharing among other things and is one of the most ubiquitous protocols, being present in both Unix and Windows environments.

RDP (Remote Desktop Protocol) is a proprietary protocol developed by Microsoft for the purpose of providing remote terminal services by transfering graphics display information from the remote computer to the user and transporting input commands from the user to the remote computer. Fortunately, Microsoft recently decided to open the protocol's internal workings to the public and has provided official documentation, which can be found at http://msdn.microsoft.com/en-us/library/cc240445(v=PROT.10).aspx

RDP is one of the most complex protocols, requiring the exchange of many packets, even for just the authentication phase. For this reason, cracking it takes a lot of time and this is probably the slowest module. The connection phase is briefly described at http://msdn.microsoft.com/en-us/library/cc240452(v=PROT.10).aspx where you can also see a diagram of the various packets involved. Care must be taken against RDP servers in Windows XP versions, since they can't handle multiple connections at the same time. It is advised to use a very slow timing template or even better limit the maximum parallel connections using timing options such as CL (Connection Limit) or cd (connection delay) against Windows XP (and relevant) RDP servers. Windows Vista and above don't suffer from the same limitation.

The VNC protocol has known widespread usage among Unix administrators and users for remote graphical access. VNC is perhaps one of the most vulnerable protocols in terms of brute-forcing, since it often requires a password without a corresponding username for authentication. In addition, some versions of VNC impose an 8-character limit in password length. You should consider adding the --passwords-first option when cracking VNC systems to exploit the fact that the username often has no actual importance in authentication.

POP3 support is still experimental and hasn't been thoroughly tested. You can expect it to work against common mail servers, nevertheless.

The Internet Message Access Protocol (IMAP) is used by email clients to retrieve email messages from a mail server. The module sends the LOGIN command to authenticate. The LOGIN command is the simplest, fastest and most supported authentication mechanism for IMAP.

The Session Initiation Protocol is a text-based protocol, very similar to HTTP in its structure. The most common application of SIP is in Internet telephony for voice and video calls. Nearly all enterprises have infrastructure that supports conference calls and part of them are based on SIP, making the authentication part a significant threat vector.

Redis is one of the most widely used caching servers and the most popular NoSQL database. Despite its reputation, the authentication mechanism is very simple, only allowing for a password to protect remote access to the service. Due to the high performance of Redis and the fact that only 2 packets are needed for the authentication phase, Ncrack can try a lot of passwords in parallel (http://redis.io/commands/AUTH). Specifying a username list or single username will have no effect in this module, since Redis only deals with passwords.

PostgreSQL is often used as a backend database. The PostgreSQL module supports md5 authentication, which is the most frequent password authentication method.

The MySQL module supports native authentication.

The MSSQL module supports mixed authentication.

The MongoDB module supports MongoDB-CR and SCRAM-SHA-1 authentication. The pairwise and passwords-first option will be ignored for the MongoDB module, due to them being inefficient against MongoDB. The optimal way of cracking MongoDB is to take advantage of a user-enumeration vulnerability inherent in its authentication mechanism, which Ncrack exploits.

Apache Cassandra is a popular NoSQL database often left unsecured with weak credentials or no authentication.

Outlook Web App allows users to access a Microsoft Exchange Server mailbox from a web browser and experience Microsoft Outlook without a mail client. The module supports Basic Authentication.

Windows Remote Management (WinRM) is the Microsoft implementation of WS-Management Protocol, a standard Simple Object Access Protocol (SOAP)-based, firewall-friendly protocol that allows hardware and operating systems, from different vendors, to interoperate. It is often used to administer Windows machines. The module supports Basic and Negotiate authentication.

Digital Imaging and Communications in Medicine (DICOM) is a protocol used heavily in healthcare environments. Most commonly, it is used as both a file format and network protocol by Picture Archiving and Communication Systems (PACS). The client of a DICOM service is called a service class user (SCU) and the server a service class provider (SCP). DICOM is very unique in how it authenticates clients to servers; there are potentially one to three steps involved: Association, Find Service and Retrieve Images.

Association: This is the initial step that almost all PACS servers require. By sending an A-ASSOCIATE request with the correct called Application Entity Title (AET) the client associates with the server and then can go on to perform query / retrieve requests in the next steps. This is the mode that Ncrack currently supports by iterating through the username field. Thus to brute-force the server's AET, you can specify a list of AETs using the -U option and then specifying a null password. Example: ncrack dicom://127.0.0.1 -U aet.txt --pass DOESNOTMATTER

Find Service: This step involves being able to query the PACS server for patient studies that are associated with DICOM images. This takes place after the client has performed the Association phase. A C-FIND request must be sent with the correct calling AET. Knowing the correct allowed client AET (or calling AET) is required by securely configured PACS servers. Many PACS servers by default do not require this.

Retrieve Images: This step allows a client to retrieve DICOM images. The most hardened PACS servers will require the client to have a specific allowed IP configured in order to send a C-MOVE / C-STORE request after the above two steps have been performed.

The Message Queueing Telemetry Transport (MQTT) protocol is a publish / subscribe machine to machine protocol that allows IoT clients to publish to a broker. Each client device subscribes to a particular topic of interest and receives messages from publishers. Usually MQTT authentication is optional and when enabled can be brute-forced very easily as it only requires a single MQTT CONNECT packet to be sent for each attemped credential pair.

Wodpress is one of the most popular content management systems. This module attacks the web administration endpoint. By default it will try "wp-login.php" but you can change it by specifying the path. For example: ncrack wp://127.0.0.1,path=/non-default/wp-login.php

The Concurrent Versioning System (CVS) is a revision control system in software development. Although not as popular nowadays, there are many old, oudated CVS servers out there that might have default or weak credentials.