zombie

name	zombie
description	Use this skill when working with zombie for authorized weak credential checks and authentication result analysis.
internal	true

Zombie

Zombie is the weak credential checking tool in aiscan.

Capabilities:

• test supported network services for weak credentials when authorized
• report service URI, protocol, host, port, module, username, password, and authentication result
• distinguish successful credentials, failed attempts, connection errors, lockouts, and unsupported services
• expose retry, timeout, and module-specific messages

Common usage:

zombie -i 192.168.1.1:3306 -s mysql --concurrency 8
zombie -i 192.168.1.1:22 -s ssh -u root -p admin123,123456,root --concurrency 8
zombie -i 192.168.1.1:6379 -s redis --concurrency 8
zombie -i 192.168.1.1:15672 -s rabbitmq --concurrency 8
zombie -I targets.txt -s ssh --top 10 --concurrency 8
zombie -i 192.168.1.1:8080 -s tomcat -u admin,tomcat -p admin,tomcat,s3cret --concurrency 8
zombie -i 192.168.1.1:23 -s telnet -u admin -p admin --concurrency 8

Key flags:

• -i: target ip:port (can repeat: -i host1:3306 -i host2:3306). Also accepts ssh://user@host:22 URL format.
• -s: service name — required when target has no scheme prefix. Services: ssh, mysql, redis, ftp, rdp, smb, tomcat, nacos, minio, rabbitmq, etc.
• -u: username(s), comma-separated or repeated.
• -p, --pwd: password(s), comma-separated or repeated. Prefer -p. Do not use --password; upstream zombie does not define it.
• -I: target file (uppercase I, one ip:port per line).
• --top N: use top N common passwords from built-in dictionary.
• --concurrency N: max concurrent connections per host. Use --concurrency 8 by default, especially for Telnet/Comware-style devices.
• -t: global thread count (default 100). Not target — use -i for target. Do not use -t as the default per-host concurrency limiter when --concurrency is available.
• -c: CIDR input. Not concurrency; do not emit -c 8.
• -l: list supported services and exit (not a file flag!).

Common mistakes:

# WRONG:
zombie -t 10.0.0.1 -p 3306 -s mysql    # -t is threads, not target
zombie -l targets.txt -s ssh            # -l lists services, not reads file
zombie -i 10.0.0.1:3306                 # missing -s mysql
zombie -i 10.0.0.1:23 -s telnet --password admin  # use -p/--pwd for passwords
zombie -i 10.0.0.1:23 -s telnet -p admin -c 8     # -c is CIDR, not concurrency

# RIGHT:
zombie -i 10.0.0.1:3306 -s mysql --concurrency 8
zombie -I targets.txt -s ssh --concurrency 8
zombie -i 10.0.0.1:3306 -s mysql -t 50 --concurrency 8
zombie -i 10.0.0.1:23 -s telnet -p admin --concurrency 8