Nmap Password Cracking Unleashed: Mastering NSE Brute-Force Attacks for Red Teaming and Defense + Video

By /

Listen to this Post

Featured Image

Introduction:

The Nmap Scripting Engine (NSE) transforms Nmap from a simple port scanner into a multi-protocol brute-force attack framework. Attackers leverage built-in scripts like ftp-brute, ssh-brute, and `http-brute` to automate dictionary attacks across FTP, SSH, SMB, MySQL, and more, extracting valid credentials that lead to initial access. Understanding these techniques is essential for both penetration testers and defenders aiming to harden network perimeters against credential-based breaches.

Learning Objectives:

  • Execute dictionary brute-force attacks using Nmap NSE scripts against FTP, SSH, Telnet, SMB, MySQL, PostgreSQL, HTTP, and MSSQL services.
  • Customize wordlist paths, timeout values, and parallel execution parameters to optimize password cracking attempts.
  • Implement detection, mitigation, and hardening strategies including rate limiting, fail2ban, strong password policies, and network segmentation.

You Should Know:

  1. Setting Up Nmap and Wordlists for Brute-Force Attacks
    Nmap’s NSE brute scripts require wordlists for usernames and passwords. On Linux, install Nmap via `sudo apt install nmap -y` (Debian/Ubuntu) or `sudo yum install nmap` (RHEL). On Windows, download the Nmap installer from nmap.org or use Windows Subsystem for Linux (WSL). Prepare wordlists – use the classic `rockyou.txt` (after extracting gunzip /usr/share/wordlists/rockyou.txt.gz) or create custom lists.

Step‑by‑step:

1. Verify Nmap installation: `nmap –version`

  1. List all brute NSE scripts: `ls /usr/share/nmap/scripts/brute.nse` or `locate .nse | grep -i brute`
    3. Create a sample username list (users.txt) and password list (pass.txt):

    echo -e "admin\nroot\nuser" > users.txt
echo -e "password\n123456\nadmin" > pass.txt
  2. Test script availability: `nmap –script-help ftp-brute` – this displays script usage.

2. Cracking FTP Passwords with ftp-brute.nse

FTP remains a common target due to legacy systems and weak credentials. The `ftp-brute.nse` script attempts login combinations from specified wordlists.

Command:

nmap -p21 --script ftp-brute --script-args userdb=users.txt,passdb=pass.txt,unpwdb.timelimit=60 <target-IP>

– `-p21` restricts scanning to FTP port.
– `userdb` and `passdb` point to your wordlists.
– `unpwdb.timelimit` (optional) sets brute-force duration in seconds.

Windows equivalent: Run the same command from Nmap installed on Windows or use PowerShell with `Test-1etConnection` for port checks, but Nmap is recommended.

What it does: The script connects to FTP, issues `USER` and `PASS` commands for each combination. When a match is found, credentials are displayed. Attackers use this to gain file access or pivot internally.

Mitigation: Disable anonymous FTP, enforce strong passwords, use FTPS/SFTP, monitor `/var/log/auth.log` for repeated failures, and deploy fail2ban with an FTP jail.

3. SSH Brute-Forcing: Parallel Dictionary Attacks

SSH brute‑forcing is extremely common. The `ssh-brute.nse` script supports custom timeouts and parallel threads.

Command:

nmap -p22 --script ssh-brute --script-args userdb=users.txt,passdb=pass.txt,brute.firstonly=true,brute.maxthreads=5 192.168.1.150

– `brute.firstonly=true` stops after finding first valid credential.
– `brute.maxthreads=5` limits concurrent connections to avoid detection.

Step‑by‑step guide:

  1. Ensure SSH service is open on the target: `nc -zv 22`

2. Run the brute script with your wordlists.

  1. If successful, the output shows Account found: root:password123.
  2. Use found credentials to gain shell access: `ssh root@`

    Defense: Disable root login (PermitRootLogin no), use key‑based authentication, set `MaxAuthTries` to 3, and configure `fail2ban` for SSH. Monitor `/var/log/secure` or `auth.log` for repeated failures.

4. Telnet and Legacy Protocol Exploitation

Telnet transmits credentials in plaintext, making brute‑force attacks trivial. The `telnet-brute.nse` script works similarly but with a default 5‑second timeout.

Command:

nmap -p23 --script telnet-brute --script-args userdb=users.txt,passdb=pass.txt 192.168.1.150

What this does: The script connects to port 23, sends username, then password. Upon success, it captures the login prompt. Attackers use this to compromise industrial control systems (ICS), older network devices, or misconfigured servers.

Hardening: Completely disable Telnet on all systems; replace with SSH. If unavoidable, restrict access via ACLs, VPNs, and monitor logs for `telnetd` authentication failures. Use `iptables` to limit connections: iptables -A INPUT -p tcp --dport 23 -m connlimit --connlimit-above 3 -j DROP.

5. Database Attacks: MySQL and Postgres Brute-Force

Databases often hold sensitive data. Nmap includes `mysql-brute` and `postgres-brute` scripts to guess credentials.

MySQL example:

nmap -p3306 --script mysql-brute --script-args userdb=users.txt,passdb=pass.txt <target-IP>

PostgreSQL example:

nmap -p5432 --script postgres-brute --script-args userdb=users.txt,passdb=pass.txt <target-IP>

Step‑by‑step exploitation:

  1. Discover open database ports using nmap -sS -p3306,5432 <target>.

2. Run the respective brute script.

  1. On success, connect using `mysql -u found_user -p -h ` or psql -U found_user -h <target>.

Mitigation: Use strong, unique passwords; enforce account lockout after failed attempts; run databases on non‑standard ports (obscurity only, not security); enable SSL/TLS; audit logs for brute‑force patterns. For MySQL, set `max_connect_errors` and use `FAILED_LOGIN_ATTEMPTS` plugin.

6. Web and SMB Password Cracking

HTTP basic/digest authentication and SMB shares are frequently brute‑forced.

HTTP basic brute‑force:

nmap -p80,443 --script http-brute --script-args http-brute.path=/admin,userdb=users.txt,passdb=pass.txt <target>

– Adjust `path` to the login page (e.g., `/wp-login.php` for WordPress).

SMB brute‑force:

nmap -p445 --script smb-brute --script-args userdb=users.txt,passdb=pass.txt <target>

Windows users can also use built-in tools, but Nmap with `smb-brute` is cross‑platform.

What it does: For HTTP, the script sends `GET` or `POST` requests with `Authorization` headers. For SMB, it uses NetBIOS/SMB session setup requests. Valid credentials allow file access or remote execution (e.g., via PsExec).

Defense: For web apps, implement CAPTCHA, rate limiting, and multi‑factor authentication (MFA). For SMB, disable SMBv1, enforce strong passwords, use account lockout policies, and monitor event IDs 4625 (failed logons) on Windows domain controllers.

7. Detection and Mitigation Strategies

Proactive defense against Nmap brute‑force attacks involves multiple layers.

Detection commands (Linux):

  • Monitor real‑time failed SSH attempts: `tail -f /var/log/auth.log | grep “Failed password”`
    – Count brute attempts per IP: `sudo grep “Failed password” /var/log/auth.log | awk ‘{print $(NF-3)}’ | sort | uniq -c | sort -1r`
    – Install and configure fail2ban:

    sudo apt install fail2ban -y
sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local
Edit jail.local to enable [bash], [bash], etc.
sudo systemctl enable fail2ban && sudo systemctl start fail2ban
  • Use `nmap` defensively to audit your own services: `nmap -p21,22,23,3306,5432 –script brute –script-args brute.mode=passive `

Windows detection:

  • Enable auditing of logon events via Group Policy: Computer Configuration → Windows Settings → Security Settings → Local Policies → Audit Policy → Audit Logon Events (Success/Failure).
  • Use PowerShell to query security event log for event ID 4625: `Get-WinEvent -FilterHashtable @{LogName=’Security’; ID=4625} | Select-Object TimeCreated, Message`
    – Deploy `Sysmon` and forward logs to a SIEM.

Hardening steps: Enforce password complexity (minimum 12 chars, upper/lower/digit/special); implement account lockout after 5 failures; use MFA everywhere possible; segment networks to limit lateral movement; regularly rotate credentials and audit exposed services.

What Undercode Say:

  • Key Takeaway 1: Nmap’s NSE brute scripts are not just theoretical – they work out‑of‑the‑box with default wordlists and can compromise poorly protected FTP, SSH, and database services within minutes.
  • Key Takeaway 2: Defenders must assume that attackers will use these exact techniques; proactive monitoring of authentication logs, rate limiting, and strong password policies are the most effective countermeasures.

Analysis: The post highlights a critical blind spot: many security teams view Nmap only as a scanner, overlooking its offensive capabilities. Attackers use `ftp-brute` and `ssh-brute` in initial access phases, often combined with password reuse from breached databases. While these scripts are noisy, they succeed against misconfigurations – default credentials, blank passwords, or common weak combos like admin:admin. Red teams can leverage parallel execution across protocols to map credential reuse. Blue teams should deploy honeypot services on high‑risk ports (21,22,445) to detect brute‑force attempts early. Additionally, organizations should move beyond simple lockout policies and implement geo‑blocking, conditional access, and passwordless authentication where feasible. The real risk isn’t Nmap itself but the failure to enforce basic credential hygiene.

Prediction:

  • -1 Increased automation of NSE brute‑force in botnets: Adversaries will integrate Nmap’s NSE scripts into IoT botnets, scanning for and cracking FTP/SSH credentials at scale, leading to a rise in cryptojacking and ransomware initial access vectors.
  • -1 Legacy protocol exploitation will persist: Telnet and SMBv1 remain prevalent in OT/ICS environments; as Nmap scripts become more accessible, attackers will target these sectors, causing operational disruptions.
  • +1 Defensive adoption of NSE for audits will grow: Security teams will embrace Nmap’s brute scripts as automated password strength testers, integrating them into CI/CD pipelines to continuously validate credential policies.
  • -1 Password spraying vs. account lockout evasion: Attackers will shift to low‑and‑slow password spraying using Nmap’s `brute.mode` options, bypassing naive lockout thresholds and forcing defenders to adopt more advanced anomaly detection.

▶️ Related Video (82% Match):

🎯Let’s Practice For Free:

🎓 Live Courses & Certifications:

Join Undercode Academy for Verified Certifications

🚀 Request a Custom Project:

Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands

IT/Security Reporter URL:

Reported By: Nmap Password – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅

🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]

💬 Whatsapp | 💬 Telegram

📢 Follow UndercodeTesting & Stay Tuned:

𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin | 🦋BlueSky

Related Posts: