legba

# legba legba is a fast, multi-protocol credential bruteforcer, password sprayer, and enumerator written in Rust on top of the Tokio async runtime. It is a modern replacement for THC-Hydra, Medusa, Ncrack, and Patator — benchmarked at 4.5× faster on HTTP basic auth, 55× faster on SSH, 3.8× on MySQL vs. Hydra on identical hardware. It ships as a single static binary with no native dependencies and supports 30+ protocol plugins. Full documentation: https://legba.evilsocket.net/ GitHub: https://github.com/evilsocket/legba ## Installation ```bash # Precompiled binary (Linux/macOS) — recommended # Download the latest release from https://github.com/evilsocket/legba/releases # Homebrew (macOS / Linux) brew tap evilsocket/legba https://github.com/evilsocket/legba brew install legba # Cargo cargo install legba # Docker docker run ghcr.io/evilsocket/legba [args] ``` Full install instructions: https://legba.evilsocket.net/install/ ## Core Concepts ### Target Syntax | Format | Example | |---|---| | Single host | `192.168.1.1` | | Hostname | `example.com` | | IP range | `192.168.1.1-192.168.1.254` | | CIDR | `192.168.1.0/24` | | IPv6 | `[::1]` | | File of targets | `@targets.txt` | | Comma-separated | `host1,host2,host3` | ### Credential Expression Syntax Credentials (username, password, payload) are flexible expressions, not just plain wordlist paths. | Expression | Meaning | |---|---| | `admin` | A single constant value | | `@wordlist.txt` | One entry per line from a file | | `@/path/to/*.txt` | Glob — load all matching files | | `{user}` | Template — substitute the current username into the password expression | | `[0-9999]` | Integer range, zero-padded automatically | | `word#3` | Permutations: `word` with all 3-character suffixes | | `a,b,c` | Explicit comma-separated list | ### Iteration Modes By default legba iterates over passwords for each username. Change with `--iterate` (`-I`): ```bash -I user # iterate over usernames for each password (password spray) -I password # default: iterate over passwords for each username (brute-force) ``` ## Key CLI Options | Flag | Description | |---|---| | `--target` | Target host/expression (required) | | `--username` | Username or credential expression | | `--password` | Password or credential expression | | `--concurrency` | Number of parallel workers (default: 10) | | `--rate-limit` | Max requests per second (e.g. `--rate-limit 5`) | | `--timeout` | Connection timeout in seconds | | `--retry-times` | Number of retries on failure | | `--jitter-min/max` | Add random delay (ms) between attempts | | `--session` | Path to session file for save/resume | | `--output` | Output file path | | `--output-format` | `text` (default), `csv`, or `jsonl` | | `--single-match` | Stop after the first successful credential | | `--iterate` / `-I` | Iteration strategy: `user` or `password` | | `--api` | Start REST API on `host:port` | | `--mcp` | Start MCP server (`host:port` for SSE, `stdio` for stdio mode) | Full usage reference: https://legba.evilsocket.net/usage/ ## Supported Plugins **Before generating a command for a specific plugin, fetch its documentation page** to get the correct flags and examples. | Plugin(s) | Description | Docs | |---|---|---| | `http`, `http.basic`, `http.form`, `http.ntlm1`, `http.ntlm2`, `http.enum`, `http.vhost` | HTTP auth (basic, form with CSRF, NTLMv1/v2), page enumeration, vhost enumeration | https://legba.evilsocket.net/plugins/http/ | | `ssh`, `sftp` | Password and private-key authentication | https://legba.evilsocket.net/plugins/ssh_and_sftp/ | | `ftp` | FTP password auth | https://legba.evilsocket.net/plugins/ftp/ | | `smtp` | SMTP auth (PLAIN, LOGIN, XOAUTH2, NTLM, NTLMv1); STARTTLS | https://legba.evilsocket.net/plugins/smtp/ | | `imap` | IMAP password auth | https://legba.evilsocket.net/plugins/imap/ | | `pop3` | POP3 password auth, optional SSL | https://legba.evilsocket.net/plugins/pop3/ | | `rdp` | RDP password auth, NTLM hash, admin/auto-logon modes | https://legba.evilsocket.net/plugins/rdp/ | | `vnc` | VNC password auth | https://legba.evilsocket.net/plugins/vnc/ | | `smb`, `smb.shares` | SMB/Samba credential brute-force and share enumeration | https://legba.evilsocket.net/plugins/samba/ | | `ldap` | LDAP bind auth | https://legba.evilsocket.net/plugins/ldap/ | | `kerberos` | Kerberos 5 pre-auth brute-force and user enumeration | https://legba.evilsocket.net/plugins/kerberos/ | | `mysql` | MySQL auth | https://legba.evilsocket.net/plugins/mysql/ | | `pgsql` | PostgreSQL auth | https://legba.evilsocket.net/plugins/postgresql/ | | `mssql` | Microsoft SQL Server auth | https://legba.evilsocket.net/plugins/mssql/ | | `oracle` | Oracle DB auth (requires `--features oracle` at build time) | https://legba.evilsocket.net/plugins/oracle/ | | `mongodb` | MongoDB password auth | https://legba.evilsocket.net/plugins/mongodb/ | | `scylla` | ScyllaDB / Apache Cassandra auth | https://legba.evilsocket.net/plugins/scylla/ | | `redis` | Redis legacy and ACL auth, optional SSL | https://legba.evilsocket.net/plugins/redis/ | | `amqp` | AMQP brokers: ActiveMQ, RabbitMQ, Qpid, JORAM, Solace | https://legba.evilsocket.net/plugins/amqp/ | | `mqtt` | MQTT v3/v5, optional TLS | https://legba.evilsocket.net/plugins/mqtt/ | | `stomp` | STOMP brokers: ActiveMQ, RabbitMQ, HornetQ, OpenMQ | https://legba.evilsocket.net/plugins/stomp/ | | `snmp1`, `snmp2`, `snmp3` | SNMP v1/v2 community string enum, v3 username/password enum, OID tree walking | https://legba.evilsocket.net/plugins/snmp/ | | `irc` | IRC password auth, optional TLS | https://legba.evilsocket.net/plugins/irc/ | | `telnet` | Telnet auth with configurable login/password/shell prompts | https://legba.evilsocket.net/plugins/telnet/ | | `dns` | DNS subdomain enumeration, custom resolvers, HTTPS cert fetch | https://legba.evilsocket.net/plugins/dns/ | | `port.scanner` | TCP/UDP port scanner with banner grabbing and HTTP/S header grabs | https://legba.evilsocket.net/plugins/port_scanner/ | | `socks5` | SOCKS5 username/password auth | https://legba.evilsocket.net/plugins/socks5/ | | `cmd` | Wrap any external CLI tool; detect success via exit code or stdout pattern | https://legba.evilsocket.net/plugins/custom_binary/ | ## Recipe System Recipes are YAML files that define reusable, parameterized attack configurations. They support variable substitution (`{$var or default}`) and resource embedding relative to the recipe path. ```bash legba --recipe attack.yaml # Override recipe variables at runtime: legba --recipe attack.yaml --set target=192.168.1.1 --set wordlist=passwords.txt ``` Recipes are ideal for complex flows: CSRF token grabbing, multi-step auth, custom headers, or repeatable pentest engagements. Full recipe reference and examples: https://legba.evilsocket.net/recipes/ ## REST API Start an HTTP API alongside an attack session to query status, list running sessions, and stop them programmatically: ```bash legba http.basic --target example.com --username admin --password @pass.txt --api 127.0.0.1:8080 ``` Full REST API reference: https://legba.evilsocket.net/rest/ ## MCP Server legba is the only credential bruteforcer with a built-in Model Context Protocol (MCP) server, allowing AI agents to drive it programmatically: ```bash # SSE mode (Claude Desktop, Cline, etc.) legba --mcp 127.0.0.1:9090 # stdio mode (local agent pipelines) legba --mcp stdio ``` Full MCP setup and agent configuration snippets: https://legba.evilsocket.net/mcp/ ## Session Management Save progress and resume interrupted attacks: ```bash # Start with session tracking legba ssh --target 10.0.0.1 --username root --password @pass.txt --session /tmp/my.session # Resume later (same command, session file is detected automatically) legba ssh --target 10.0.0.1 --username root --password @pass.txt --session /tmp/my.session ``` ## Where to Look for More - **FAQ and common attack recipes**: https://legba.evilsocket.net/faq/ - **Speed comparison vs. Hydra/Medusa/Ncrack**: https://legba.evilsocket.net/comparison/ - **Reproducible benchmarks**: https://legba.evilsocket.net/benchmark/ - **Full documentation index**: https://legba.evilsocket.net/