Cracking 🔓 Ncrack - Cheatsheet, Tips and Real-World Usage

[dEEpEst]

Ncrack - Cheatsheet, Tips and Real-World Usage


This post was created for the Hack Tools Dark Community.


Ncrack is a high-speed network authentication cracking tool developed by the Nmap team.
It's ideal for brute-forcing various network services and is known for its reliability and scalability.

Disclaimer: This content is for educational purposes only and must be used exclusively in authorized environments.
Neither the author nor the HTDark community is responsible for any misuse.


What is Ncrack?
Ncrack is a fast and flexible network login cracker built for large-scale scanning and penetration testing.
It supports a wide range of protocols and was designed with performance and accuracy in mind.

Installation (Debian/Ubuntu)

sudo apt update && sudo apt install ncrack

Basic Syntax

ncrack -p <port> <target>

Supported Protocols

• ssh
• rdp
• ftp
• http
• telnet
• smtp
• mysql
• postgres
• vnc
• pop3
• smb
• rexec, rsh, rlogin

Common Examples

Brute-force SSH login with user/password lists:

ncrack -p 22 --user admin -P passwords.txt 192.168.1.10

Brute-force RDP with multiple users:

ncrack -p 3389 -U users.txt -P passwords.txt 192.168.1.10

Brute-force FTP on multiple targets:

ncrack -p ftp -U users.txt -P passwords.txt 192.168.1.0/24

Brute-force MySQL:

ncrack -p 3306 --user root -P passwords.txt 192.168.1.10

Useful Options

• -p = specify service or port
• --user / -U = username or file
• --pass / -P = password or file
• -T = timing template (0–5)
• -g = show debug info
• -oN = output to file
• --connection-limit = limit max connections
• --resume = resume previous session

Tips & Tricks

• Use CIDR ranges: Example: `192.168.1.0/24` for large-scale tests
• Avoid detection: Use lower `-T` values (1 or 2) for stealth
• Chain with Nmap: Scan open ports first, then feed to Ncrack
• Save time: Use `--pass ''` to test blank passwords
• Increase threads: Combine `--connection-limit` with `-T 5` on fast networks
• Use with VPN/proxy tunnels for anonymity

Comparison: Ncrack vs Hydra vs Medusa

• Ncrack: Best for network-wide scanning, stable, good for RDP and SSH
• Hydra: More protocol variety, flexible form attacks
• Medusa: Extremely fast, modular, better for parallel brute-force on specific hosts

Real-World Usage

# Scan subnet for SSH and RDP logins
ncrack -p ssh,rdp -U users.txt -P rockyou.txt 10.10.0.0/24 -T 4

Useful Resources

• This link is hidden for visitors. Please Log in or register now.
  - Official project page
• This link is hidden for visitors. Please Log in or register now.
  - GitHub repo
• This link is hidden for visitors. Please Log in or register now.
  - Massive wordlists

---

Do you use Ncrack in your red team workflows?
Which protocols have you had the most success with?

Share your insights and join the discussion!