Ncrack suggestion.

[Richard Miles <richard.k.miles () googlemail com>]

Hello Nmap/Ncrack developers,

I tried Ncrack for the first time during this week, and I liked it, I would
like to do two suggestions and maybe point a small bug.

I did use Ncrack to brute-force SSHv2 service. Would be awesome if you could
allows user and password from be read from a combo list, like Medusa does:

http://www.foofus.net/jmk/medusa/medusa.html

*Medusa allows host/username/password data to also be set using a "combo"
file. The combo file can be specified using the "-C" option. The file should
contain one entry per line and have the values colon separated in the format
host:user:password. If any of the three fields are left empty, the
respective information should be provided either as a global value or as a
list in a file. Medusa will perform a basic parameter check based on the
contents of the first line in the file.*

*The following combinations are possible in the combo file:*

   - host:username:password
   - host:username:
   - host::
   - :username:password
   - :username:
   - ::password
   - host::password

Another option should allow test SSH brute force against different SSH
servers in parallel, similar to Medusa option -T.

 -T [NUM]     : Total number of hosts to be tested concurrently

It would make the SSHv2 much faster if you have multiple targets.

And using Ncrack with -v it works, however if we use -vv or -vvv (more
verbose) it doesn't brute force, it shows the help again. Maybe a bug?

Maybe with more verbose you could display number of users tested? how many
tests per minute?

I really like Medusa, but it crashes a lot for SSH with -T option, too bad.
As I saw you implemented your own SSH lib you probable can do it.

That's all.

Very nice tool.

Thank you.
_______________________________________________
Sent through the nmap-dev mailing list
http://cgi.insecure.org/mailman/listinfo/nmap-dev
Archived at http://seclists.org/nmap-dev/