legba

name	legba
description	Use this skill when the user wants to brute-force credentials, spray passwords, or enumerate services/subdomains against any network protocol (HTTP, SSH, FTP, SMB, RDP, databases, mail protocols, DNS, etc.) using legba. Also use it when the user asks how to use legba, how to write a recipe, how to configure the REST API or MCP server, or asks for help constructing a legba command.

legba

legba is a fast, multi-protocol credential bruteforcer, password sprayer, and enumerator written in Rust on top of the Tokio async runtime. It is a modern replacement for THC-Hydra, Medusa, Ncrack, and Patator — benchmarked at 4.5× faster on HTTP basic auth, 55× faster on SSH, 3.8× on MySQL vs. Hydra on identical hardware. It ships as a single static binary with no native dependencies and supports 30+ protocol plugins.

Full documentation: https://legba.evilsocket.net/ GitHub: https://github.com/evilsocket/legba

Installation

# Precompiled binary (Linux/macOS) — recommended
# Download the latest release from https://github.com/evilsocket/legba/releases

# Homebrew (macOS / Linux)
brew tap evilsocket/legba https://github.com/evilsocket/legba
brew install legba

# Cargo
cargo install legba

# Docker
docker run ghcr.io/evilsocket/legba [args]

Full install instructions: https://legba.evilsocket.net/install/

Core Concepts

Target Syntax

Format	Example
Single host	192.168.1.1
Hostname	example.com
IP range	192.168.1.1-192.168.1.254
CIDR	192.168.1.0/24
IPv6	[::1]
File of targets	@targets.txt
Comma-separated	host1,host2,host3

Credential Expression Syntax

Credentials (username, password, payload) are flexible expressions, not just plain wordlist paths.

Expression	Meaning
admin	A single constant value
@wordlist.txt	One entry per line from a file
@/path/to/*.txt	Glob — load all matching files
{user}	Template — substitute the current username into the password expression
[0-9999]	Integer range, zero-padded automatically
word#3	Permutations: word with all 3-character suffixes
a,b,c	Explicit comma-separated list

Iteration Modes

By default legba iterates over passwords for each username. Change with --iterate (-I):

-I user      # iterate over usernames for each password (password spray)
-I password  # default: iterate over passwords for each username (brute-force)

Key CLI Options

Flag	Description
--target	Target host/expression (required)
--username	Username or credential expression
--password	Password or credential expression
--concurrency	Number of parallel workers (default: 10)
--rate-limit	Max requests per second (e.g. --rate-limit 5)
--timeout	Connection timeout in seconds
--retry-times	Number of retries on failure
--jitter-min/max	Add random delay (ms) between attempts
--session	Path to session file for save/resume
--output	Output file path
--output-format	text (default), csv, or jsonl
--single-match	Stop after the first successful credential
--iterate / -I	Iteration strategy: user or password
--api	Start REST API on host:port
--mcp	Start MCP server (host:port for SSE, stdio for stdio mode)

Full usage reference: https://legba.evilsocket.net/usage/

Supported Plugins

Before generating a command for a specific plugin, fetch its documentation page to get the correct flags and examples.

Plugin(s)	Description	Docs
http, http.basic, http.form, http.ntlm1, http.ntlm2, http.enum, http.vhost	HTTP auth (basic, form with CSRF, NTLMv1/v2), page enumeration, vhost enumeration	https://legba.evilsocket.net/plugins/http/
ssh, sftp	Password and private-key authentication	https://legba.evilsocket.net/plugins/ssh_and_sftp/
ftp	FTP password auth	https://legba.evilsocket.net/plugins/ftp/
smtp	SMTP auth (PLAIN, LOGIN, XOAUTH2, NTLM, NTLMv1); STARTTLS	https://legba.evilsocket.net/plugins/smtp/
imap	IMAP password auth	https://legba.evilsocket.net/plugins/imap/
pop3	POP3 password auth, optional SSL	https://legba.evilsocket.net/plugins/pop3/
rdp	RDP password auth, NTLM hash, admin/auto-logon modes	https://legba.evilsocket.net/plugins/rdp/
vnc	VNC password auth	https://legba.evilsocket.net/plugins/vnc/
smb, smb.shares	SMB/Samba credential brute-force and share enumeration	https://legba.evilsocket.net/plugins/samba/
ldap	LDAP bind auth	https://legba.evilsocket.net/plugins/ldap/
kerberos	Kerberos 5 pre-auth brute-force and user enumeration

Recipe System

Recipes are YAML files that define reusable, parameterized attack configurations. They support variable substitution ({$var or default}) and resource embedding relative to the recipe path.

legba --recipe attack.yaml
# Override recipe variables at runtime:
legba --recipe attack.yaml --set target=192.168.1.1 --set wordlist=passwords.txt

Recipes are ideal for complex flows: CSRF token grabbing, multi-step auth, custom headers, or repeatable pentest engagements.

Full recipe reference and examples: https://legba.evilsocket.net/recipes/

REST API

Start an HTTP API alongside an attack session to query status, list running sessions, and stop them programmatically:

legba http.basic --target example.com --username admin --password @pass.txt --api 127.0.0.1:8080

Full REST API reference: https://legba.evilsocket.net/rest/

MCP Server

legba is the only credential bruteforcer with a built-in Model Context Protocol (MCP) server, allowing AI agents to drive it programmatically:

# SSE mode (Claude Desktop, Cline, etc.)
legba --mcp 127.0.0.1:9090

# stdio mode (local agent pipelines)
legba --mcp stdio

Full MCP setup and agent configuration snippets: https://legba.evilsocket.net/mcp/

Session Management

Save progress and resume interrupted attacks:

# Start with session tracking
legba ssh --target 10.0.0.1 --username root --password @pass.txt --session /tmp/my.session

# Resume later (same command, session file is detected automatically)
legba ssh --target 10.0.0.1 --username root --password @pass.txt --session /tmp/my.session

Where to Look for More

• FAQ and common attack recipes: https://legba.evilsocket.net/faq/
• Speed comparison vs. Hydra/Medusa/Ncrack: https://legba.evilsocket.net/comparison/
• Reproducible benchmarks: https://legba.evilsocket.net/benchmark/
• Full documentation index: https://legba.evilsocket.net/