brutus - Fast, zero-dependency credential testing tool in G

项目说明

<img width="2752" height="1536" alt="Brutus - Social" src=" />
<h1 align="center">Brutus</h1>

<p align="center">
<em>"Et tu, Brute?" — The last words before credentials fall.</em>
</p>

<p align="center">
<strong>Modern credential testing tool in pure Go</strong>
</p>

<p align="center">
<a href="#installation">Installation</a> •
<a href="#quick-start">Quick Start</a> •
<a href="#pipeline-integration">Pipeline</a> •
<a href="#supported-protocols">Protocols</a> •
<a href="#account-enumeration">Enumeration</a> •
<a href="#socks5-proxy-support">Proxy</a> •
<a href="#library-integration">Library</a>
</p>

---

O

Brutus is a multi-protocol authentication testing tool designed to address a critical gap in offensi tooling: efficient credential across diverse network services. While HTTP-focused tools are abundant, penetration testers and red team operators frequently encounter databases, SSH, SMB, and other network services that require purpose-built authentication testing capabilities.

Built in Go as a single binary with zero external dependencies, Brutus integrates seamlessly with Nerva for automated service discovery, enabling operators to rapidly identify and test authentication across entire network ranges.

Key features:

Zero dependencies: Single binary, cross-platform (Linux, Windows, macOS)

43 protocols: SSH, RDP, MySQL, PostgreSQL, MSSQL, Oracle, Redis, SMB, LDAP, WinRM, SNMP, HTTP Basic Auth, MQTT, and more

SOCKS5 proxy support: Route all traffic through a SOCKS5 proxy with --proxy

Aggressi modes: --mode cautious|default|aggressive for tuning co

Pipeline integration: Nati for Ner, nmap, and masscan workflows

Embedded bad keys: Built-in collection of known SSH keys (, F5, ExaGrid, etc.)

Account enumeration: account-existence oracle enumeration, Kerberos user enumeration, email generation, Microsoft Teams/Entra ID device code auth

Go library: Import directly into your security automation tools

Production ready: Rate limiting, connection pooling, and comprehensi handling

---

Why Brutus?

Traditional tools like THC Hydra ha the security community well, but they come with significant friction: complex dependency chains, platform-specific compilation issues, and no nati with modern reconnaissance workflows.

Brutus is purpose-built for modern offensi:

True zero-dependency deployment: Download a single binary and run. No libssh-dev, no libmysqlclient-dev, no compilation errors. Works identically on Linux, macOS, and Windows.

Nati integration: Brutus speaks JSON and integrates directly with Nerva, naabu, nmap, and masscan. Pipe discovered services straight into credential testing without format con or scripting.

Embedded intelligence: Known SSH bad keys (, F5 BIG-IP, ExaGrid, etc.) are compiled into the binary. Use brutus badkeys to test them against SSH targets.

Library-first design: Import Brutus directly into your Go security tools. Build custom automation without shelling out to external processes.

---

Use Cases

Penetration Testing

discovered credentials across multiple services during internal assessments

Test password reuse patterns across database and file share services

Identify default credentials on newly deployed infrastructure

Red Team Operations

Rapid credential after password dumps or phishing campaigns

Test lateral mo opportunities across network services

compromised credentials across heterogeneous en

Private Key Spraying

Found a private key on a compromised system? Spray it across the network to find where else it grants access:

This pipeline discovers all SSH services, identifies them with Nerva, and tests the compromised key against common usernames—re lateral mo opportunities in seconds.

Web Admin Panel Testing

Discover HTTP services and test credentials using AI-powered detection or manual credential lists:

Security

Test default credentials on newly deployed services

password policy enforcement across platforms

Generate audit trails for compliance and security assessments

---

Installation

Pre-built Binaries (Recommended)

Download from GitHub Releases:

Go Install

---

Quick Start

Subcommands

<!-- BEGIN generated: cli-subcommands -->
Brutus organizes its functionality into these focused subcommands:

<!-- END generated: cli-subcommands -->

<!-- BEGIN generated: cli-aliases -->
Some subcommands carry aliases for disco:

| Subcommand | Aliases |
| --- | --- |
| badkeys | keys, ssh-keys, badkey |
| creds | services, defaults, credentials |
| snmp | community |
| web | http, panels |

The full reference — every subcommand, alias and flag, including the ones hidden from --help — is generated into docs/CLI.md.
<!-- END generated: cli-aliases -->

Basic Usage

Output Example

With mode (-v):

JSON output for pipeline integration (outputs only successful credentials):

---

Pipeline Integration

Brutus integrates seamlessly with Nerva and naabu for complete network reconnaissance.

Real-World Scenarios

#### Scenario 1: Scanning a Corporate /24 Network

#### Scenario 2: Bug Bounty Recon on a Target Domain

#### Scenario 3: Database Hunting in an Internal Assessment

#### Scenario 4: SSH Key Testing Across Infrastructure

#### Scenario 5: Targeted Service Testing

Scan Tool Import (Nmap & Masscan)

Brutus can import targets directly from nmap and masscan scan output files, eliminating the need for format con or intermediate tools.

#### Nmap XML Import (--nmap-file)

Import targets from nmap's XML output (-oX). Nmap provides service fingerprinting, so Brutus automatically maps detected services to the correct protocol:

Nmap service names are automatically mapped to Brutus protocols (e.g., ms-wbt-server → rdp, microsoft-ds → smb). TLS is detected from nmap's tunnel="ssl" attribute. Only open ports on up hosts are imported.

#### Masscan JSON Import (--masscan-file)

Import targets from masscan's JSON output (-oJ). Since masscan is a port scanner only (no service fingerprinting), you must either specify --protocol or let Brutus auto-fingerprint with Nerva:

#### Combining with Other Workflows

The --nmap-file and --masscan-file flags work with all subcommands and are mutually exclusive with --target, --targets-file, and stdin:

Pipeline Input Format

Brutus accepts multiple input formats from stdin:

Nerva JSON (ner):

Nerva URI (default Ner, no --json needed):

Bare targets (auto-fingerprinted with Nerva):

Brutus automatically:

Parses JSON, URI scheme, and bare target formats

Maps services to protocols

Tests appropriate default credentials

Outputs results in matching JSON format

Pipeline Output Format

Brutus outputs only successful credentials in JSONL format (one JSON object per line):

Note: Failed authentication attempts are not included in JSON output. The key field appears (as true) when authentication used an SSH key instead of a password. The llm_suggested field appears (as true) when credentials were suggested by the AI system (--experimental-ai).

---

Comparison

| Feature | Hydra | Medusa | Ncrack | Brutus |
|---------|:-----:|:------:|:------:|:----------:|
| Single Binary | ❌ | ❌ | ❌ | ✅ |
| Zero Dependencies | ❌ | ❌ | ❌ | ✅ |
| SOCKS5 Proxy | ✅ | ❌ | ❌ | ✅ |
| Ner | ❌ | ❌ | ❌ | ✅ |
| Nmap/Masscan Import | ❌ | ❌ | ❌ | ✅ |
| JSON Streaming | ⚠️ | ❌ | ❌ | ✅ |
| Cross-Platform | ⚠️ | ⚠️ | ⚠️ | ✅ |
| Consistent Errors | ⚠️ | ⚠️ | ⚠️ | ✅ |
| Acti | ✅ | ⚠️ | ❌ | ✅ |
| Embedded Bad Keys | ❌ | ❌ | ❌ | ✅ |
| Go Library Import | ❌ | ❌ | ❌ | ✅ |

---

Supported Protocols

Brutus supports 43 protocols:

Network Services

| Protocol | Port | Auth Methods | Use Case |
|----------|------|--------------|----------|
| SSH | 22 | Password, Private Keys | Servers, network equipment |
| FTP | 21 | Password | File servers, NAS devices |
| rsync | 873 | Module secrets, Anonymous | File sync |
| Telnet | 23 | Password | Legacy systems, IoT devices |
| VNC | 5900 | Password | Remote desktops |
| RDP | 3389 | NLA/CredSSP, Password | Windows servers, workstations |
| SNMP | 161 | Community String | Network devices, printers |
| IPMI | 623/udp | RMCP | BMC / lights-out |
| OPC UA | 4840 | Username token, Anonymous | ICS/SCADA |

Web Services

| Protocol | Port | Auth Methods | Use Case |
|----------|------|--------------|----------|
| HTTP | 80 | Basic Auth | Admin panels (Grafana, Jenkins, etc.) |
| HTTPS | 443 | Basic Auth | Secure admin panels |
| Browser | 80/443 | Form | browser-based Microsoft/Entra login |

Enterprise Infrastructure

| Protocol | Port | Auth Methods | Use Case |
|----------|------|--------------|----------|
| SMB | 445 | Password, NTLM | Windows networks, file shares |
| LDAP | 389/636 | Bind DN | Acti, identity |
| WinRM | 5985/5986 | NTLM | Windows remote management |

Databases

| Protocol | Port | Auth Methods | Use Case |
|----------|------|--------------|----------|
| MySQL | 3306 | Password | Web applications |
| PostgreSQL | 5432 | Password | Modern applications |
| MSSQL | 1433 | Password | Enterprise applications |
| MongoDB | 27017 | Password | NoSQL backends |
| Redis | 6379 | Password | Caching, sessions |
| Memcached | 11211 | SASL, Anonymous | Caching |
| Neo4j | 7687 | Password | Graph databases |
| Cassandra | 9042 | Password | Distributed databases |
| CouchDB | 5984 | HTTP Basic | Document stores |
| Elasticsearch | 9200 | HTTP Basic | Search engines |
| InfluxDB | 8086 | HTTP Basic | Time-series data |
| Oracle | 1521 | Password | Enterprise databases |
| DB2 | 50000 | Password | Enterprise databases |
| Firebird | 3050 | Password | Embedded databases |

Container & Orchestration

| Protocol | Port | Auth Methods | Use Case |
|----------|------|--------------|----------|
| Docker | 2375/2376 | Unauthenticated | Exposed Docker daemons |
| Kubernetes | 6443/10250 | Unauthenticated | Exposed K8s API/kubelet |

Communications

| Protocol | Port | Auth Methods | Use Case |
|----------|------|--------------|----------|
| SMTP | 25/587 | Password | Mail relay |
| IMAP | 143/993 | Password | Mailbox access |
| POP3 | 110/995 | Password | Mailbox access |
| ActiveMQ | 61616 | Password | OpenWire brokers |
| SIP | 5060/5061 | Digest | VoIP |
| TURN | 3478 | Password | TURN relay |
| ZooKeeper | 2181 | Digest, Anonymous | Coordination |
| NATS | 4222 | Password, Anonymous | Messaging |
| XMPP | 5222 | SASL PLAIN | Chat |
| MQTT | 1883/8883 | Password, Anonymous | IoT brokers |
| AMQP | 5672/5671 | SASL PLAIN | RabbitMQ |
| Kafka | 9092 | SASL/PLAIN | Brokers |
| SOCKS5 | 1080 | SOCKS5 proxy auth | Proxies |

---

Embedded SSH Bad Keys

Single binary deployment with no external key files needed. Each key is paired with its default username for smart credential mapping, and C enables compliance queries.

Brutus carries the rapid7/ssh-badkeys and key collections embedded in the binary:

Embedded Key Collection

| Product | CVE | Default User | Description |
|---------|-----|--------------|-------------|
| | - | , root | HashiCorp insecure key |
| F5 BIG-IP | C | root | Static SSH host key |
| ExaGrid | C | root | Backup appliance backdoor |
| Monroe DASDEC | C | root | Emergency alert systems |
| Barracuda | C | cluster | Load balancer VM |
| Ceragon FibeAir | C | mateidu | Wireless backhaul |
| Array Networks | - | sync | vAPV/ |
| Quantum DXi | - | root | Deduplication appliances |
| Loadbalancer.org | - | root | Enterprise load balancers |

---

Aggressi Modes

The global --mode flag (-m) controls aggressi across all subcommands. It sets performance tuning presets that balance co against safety:

| Mode | Threads | Timeout | Rate Limit | Jitter | Retries | Use Case |
|------|---------|---------|------------|--------|---------|----------|
| cautious | 5 | 15s | 2 req/s | 500ms | 1 | Production en, avoid lockouts |
| default | 10 | 10s | Unlimited | None | 2 | Standard testing |
| aggressive | 20 | 10s | Unlimited | None | 3 | Lab/CTF en, maximum co |

Mode presets are applied first, then any explicit CLI flags o them:

For SNMP, the mode also controls the built-in wordlist depth (see SNMP Community String Testing).

---

SOCKS5 Proxy Support

The --proxy flag routes all connections through a SOCKS5 proxy. This works across all protocols and subcommands:

Supported schemes:

socks5:// — Standard SOCKS5 proxy (client-side DNS resolution)

socks5h:// — SOCKS5 with remote DNS resolution (useful when targeting internal hostnames)

---

SNMP Community String Testing

The snmp subcommand provides dedicated SNMP v1/v2c community string testing with tiered wordlists controlled by the global --mode flag:

| Mode | Strings | Co |
|------|---------|----------|
| cautious | ~25 | Common strings (public, private, community, etc.) |
| default | ~25 | Same as cautious |
| aggressive | 200+ | Comprehensi, SCADA, IP cameras, storage, etc.) |

---

Library Integration

For de building security automation tools, Brutus can also be imported as a Go library:

---

Experimental: AI-Powered Credential Detection

> ⚠️ Experimental Feature: AI features require external API keys and are under acti.

The --experimental-ai Flag

The --experimental-ai flag enables automatic credential detection for HTTP services:

How it works:

1. Detection — Brutus probes HTTP targets to detect auth type (Basic Auth )
2. Device Identification — Claude analyzes screenshots to identify the device/application
3. Credential Suggestions — Claude suggests default credentials from its training data
4. Optional Web Search — Perplexity (if configured) searches for additional credentials online
5. Testing — Tests the discovered credentials against the target

For HTTP Basic Auth targets:

Probes / to capture HTTP headers

Identifies device from Ser, WWW-Authenticate realm, etc.

Claude suggests likely default credentials

Tests credential pairs automatically

For HTTP form-based auth targets:

Uses headless Chrome to render and screenshot the page

Claude identifies the login form, device type, and suggests credentials

Perplexity (optional) searches for additional default credentials

Browser automation fills and submits the form

Requirements:

ANTHROPIC_API_KEY — Required for Claude (device identification + credential suggestions)

PERPLEXITY_API_KEY — *Optional* for additional web search research

Chrome/Chromium installed (for form-based auth only)

Non-HTTP protocols (SSH, MySQL, etc.) are unaffected by --experimental-ai — they continue to use standard credential testing.

---

RDP: Sticky Keys Backdoor Detection & Exploitation

Brutus includes automatic detection of the sticky keys backdoor (MITRE ATT&CK T1546.008) on RDP targets. This pre-authentication check runs on non-NLA RDP targets — no credentials required.

How it works:

1. Connects to the RDP target and negotiates a non-NLA session
2. Captures the login screen bitmap as a baseline
3. Sends 5x Shift key (the sticky keys trigger)
4. Captures the response bitmap
5. Heuristic analysis detects if a terminal window appeared (cmd.exe, PowerShell, etc.)
6. Optionally confirms API (when ANTHROPIC_API_KEY is set)

Detection-only mode: The logon subcommand runs sticky keys and utilman backdoor detection without brute force:

Detection output:

Command Execution (--exec)

Once a backdoor is detected, execute a command on the remote system through the pre-auth command prompt:

This connects, triggers the backdoor, types the command, presses Enter, waits for output, and saves a PNG screenshot of the result.

Interactive Web Terminal (--web)

Launch a browser-based RDP for li with the backdoor command prompt:

This starts a local HTTP server with:

Li streaming at ~10 FPS (JPEG o)

Full keyboard forwarding (PS/2 scancodes mapped from browser KeyboardEvent)

Mouse support (click, mo)

Connection status with disconnect o and reconnect button

Open the displayed URL (e.g., ) in any browser to interact with the remote RDP session. If the session disconnects due to ser idle timeout, click Reconnect to establish a new session.

> Note: Non-NLA RDP sessions have a ser idle timeout (Windows default by configuration, typically controlled by Group Policy at Computer Configuration > Administrati > Remote Desktop Services > Session Time Limits). To extend the timeout on a test target, set MaxIdleTime to 0 in the registry:
>
>

B-TP (Benign True Positi: The backdoor replacement may also indicate forgotten password recovery procedures or artifacts from authorized penetration tests.

Mass RDP Scanning Pipeline

For large-scale assessments, the logon subcommand runs backdoor detection across multiple targets. It accepts pipeline input, targets files, or nmap/masscan imports — only RDP services are tested:

Technical implementation: RDP protocol support uses IronRDP (Rust) compiled to WebAssembly and executed via wazero, maintaining Brutus's zero-CGO, single-binary design.

---

Account Enumeration

The enum subcommand enumerates which account-existence oracles work for an organization (and enumerates emails against them) or enumerates Acti users, all without sending passwords.

Account-Existence Oracle Enumeration

Identify which unauthenticated account-existence oracles (microsoft365, google, github, plus the Microsoft Teams oracle) work for an organization, them against a known-valid user, then enumerate candidate emails against the working oracles. DNS TXT recon surfaces the candidate oracles; the against --known-valid is the headline. --known-valid is required, and enumeration runs only against the oracles that confirm it:

Kerberos User Enumeration

Enumerate Acti usernames AS-REQ (no passwords sent, no lockout risk):

Email/Username Generation

Generate email addresses or usernames from embedded first/last name wordlists:

---

Hunter.io Domain Search

Disco (email, name, job title, phone, department, seniority, confidence) associated with a domain via the Hunter.io Domain Search API. Paginates automatically until all results are retrieved.

---

Microsoft Teams / Entra ID Authentication

Obtain an OAuth2 access token, refresh token, and ID token from Microsoft Entra ID (Azure AD) using the device code flow (RFC 8628). The resulting tokens can be used for Microsoft Graph API calls, Teams enumeration, and auditing like ROADtools or custom Graph queries.

How it works:

1. Brutus requests a device code from login.microsoftonline.com/{tenant}/oauth2/v2.0/de
2. A short code and URL are displayed — open the URL in any browser and enter the code
3. Brutus polls until you complete sign-in, the code expires, or you press Ctrl+C
4. On success, the access token, refresh token, and ID token are printed

Human output shows only the first 20 characters of the access token (sufficient for ). Use --json or -o to capture the full token .

Default client ID: The Microsoft Teams desktop application (1fec8e78-bce4-4aaf-ab1b-5451cc387264), a first-party public client that supports device code flow. O with --client-id to use your own app registration.

#### Teams user enumeration

Once authenticated, enumerate corporate Teams users by email address. Each
result is exists, blocked (the tenant forbids external search but the user
may exist), not found, or unknown (auth/transport failure). Personal/Live
accounts are not supported — corporate tenants only.

When a refresh token is a (via --token-file or --refresh-token), an
expired access token is renewed automatically once; otherwise a 401 degrades
gracefully to an unknown result.

---

Google Workspace account enumeration

Check whether email addresses correspond to Google accounts using two
unauthenticated oracles — no token or sign-in required:

AccountChooser SSO redirect — reveals Workspace accounts on domains

configured with single sign-on, plus the identity provider (IdP) host they
redirect to (workspace-sso).

GXLU Gmail probe — reveals Gmail-enabled accounts (gmail).

Each result is exists (with the confirming method and, for SSO, the IdP host)
or not found.

--domain reuses the same frequency-ranked first/last name generator as
enum generate; --format selects the username layout and --limit caps
generation to the first N (most-likely) candidates. --domain may be combined
with -e/-E.

---

Known Limitations

Sticky Keys Heuristic Detection

Alternating false negatives: The heuristic-only detection (brutus logon without --experimental-ai) may produce false negatives on repeated scans against the same target. After a successful detection, the cmd.exe window remains open on the server. Subsequent connections see the cmd.exe in the baseline frame, and since sending 5x Shift doesn't create a new window, the pixel difference is minimal — resulting in a "clean" . This does not affect --experimental-ai mode, which uses API analysis of the response frame directly (not a baseline- diff) and reliably identifies the terminal window regardless of prior state.

Workaround: Use --experimental-ai with ANTHROPIC_API_KEY set for consistent detection across repeated scans, or allow a cooldown between scans for the RDP session to reset.

Browser Plugin

Requires Chrome/Chromium installed locally

Headless mode may not work on all systems

Some Ja login pages may require additional wait time

项目信息

开发语言：Go

Star 数：326

技术要点

该项目属于红蓝攻防方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Fast, zero-dependency credential testing tool in Go. Brute force SSH, MySQL, PostgreSQL, Redis, MongoDB, SMB, and 20+ protocols. Hydra alternative with native nerva/naabu pipeline integration.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。