brutus is a zero-dependency Go tool that validates credentials across 43 network protocols, built for penetration testers auditing default and reused passwords in authorized engagements.
| Tool | praetorian-inc/brutus — fast, zero-dependency multi-protocol credential testing tool in Go |
| Category | Credential validation / authentication auditing |
| Primary Use | Validating default, weak, or reused credentials across SSH, MySQL, PostgreSQL, SMB, LDAP, Redis, web panels and dozens of other services during scoped engagements |
| Safe Use | Educational analysis for authorized professionals: run only against systems you own or have written permission to test, in lab environments, internal penetration tests, and compliance audits |
| Telemetry Note | Every authentication attempt generates service logs — sshd auth failures, database login errors, Windows security event logs, and SNMP traps — making the tool's activity highly visible to defenders monitoring authentication telemetry |
brutus from praetorian-inc positions itself as a modern answer to a long-standing gap in offensive security tooling: while HTTP-focused testing frameworks are abundant, network services like databases, SSH, SMB, and LDAP have historically been served by aging tools with painful dependency chains. The project's tagline — a Shakespeare pun about credentials falling — hints at its ambition, but the substance is in the engineering: a single static binary written in pure Go, shipping with zero external dependencies and claiming coverage of 43 protocols including SSH, RDP, MySQL, PostgreSQL, MSSQL, Oracle, Redis, SMB, LDAP, WinRM, SNMP, HTTP Basic Auth, and MQTT.
The README is explicit about its lineage. It frames THC Hydra as the incumbent that has served the community well but carries friction: dependency chains like libssh-dev and libmysqlclient-dev, platform-specific compilation issues, and no native integration with modern recon workflows. brutus attacks each of those pain points directly — the download-and-run deployment model, cross-platform builds for Linux, macOS, and Windows, and first-class JSON input/output that lets it slot into pipelines without format-conversion glue scripts.
The pipeline story is the architectural centerpiece. Rather than being a standalone interactive tool, brutus is designed to consume service-discovery output from nerva, naabu, nmap, and masscan over standard input, test the authentication vectors it finds, and emit results as JSON. This speaks Unix-philosophy composability, and the README's generated CLI documentation — including hidden flags documented in docs/CLI.md — suggests deliberate engineering discipline rather than a weekend project. The binary even self-documents its subcommand aliases, such as web also answering to http and panels.
Functionality is organized into focused subcommands. brutus creds handles non-HTTP services with default credentials, username lists via -U, password lists via -P, private keys via -k, and thread tuning via -t. brutus web audits HTTP panels, with an experimental --experimental-ai mode that auto-detects device types and suggests default credentials. brutus enum performs account-existence enumeration against authentication oracles and Active Directory, including Kerberos user enumeration. brutus snmp tests community strings, and brutus badkeys, brutus stickykeys, and brutus utilman round out the toolkit with SSH weak-key checks and Windows logon-screen backdoor detection.
The embedded bad-key collection deserves attention from defenders as much as operators. brutus compiles in a set of known weak or compromised SSH keys — the README names Vagrant, F5 BIG-IP, and ExaGrid — and the brutus badkeys subcommand tests them against targets. This mirrors the classic ssh-badkeys research in operational form, and it means defenders who have never rotated appliance or development-image keys have an easy, documented way to understand exactly which keys an adversary would try first.
Aggressiveness tuning is a thoughtful safety-adjacent feature. The --mode cautious|default|aggressive flag lets an operator trade coverage against the risk of lockouts and service disruption, which matters on production systems during a scoped assessment. The README also lists rate limiting, connection pooling, and comprehensive error handling under a production-readiness banner — small details that separate tools you would run against a client's fragile legacy database from those you would not.
The SOCKS5 proxy support via --proxy is operationally significant: it lets traffic route through pivots or authorized testing infrastructure, and from a defender's perspective it means source IPs in authentication logs may not reflect the true origin of testing activity. brutus also offers a library-first design — you can import it directly into Go automation instead of shelling out to an external process, which is unusual for this tool category and useful for teams building internal validation harnesses.
Installation is a one-liner either way: go install github.com/praetorian-inc/brutus/cmd/brutus@latest, or download a prebuilt release tarball for your platform from the GitHub releases page. A minimal invocation looks like brutus creds --target 192.168.1.100:22 --protocol ssh -u root -p toor, and adding --json produces machine-readable output of successful credentials only, complete with protocol, target, username, password, duration, and the service banner such as SSH-2.0-OpenSSH_8.9p1.
Output behavior is worth noting: by default only successful validations are printed, with -v adding failed attempts for tuning and debugging. The README's examples show clean per-attempt timing, and the JSON mode includes response latency — a detail that helps operators distinguish genuinely valid credentials from flaky network conditions during large runs.
The documented use cases span penetration testing (validating discovered credentials, testing password reuse, finding defaults on new infrastructure), red team operations (the README candidly describes credential validation after dumps and lateral-movement testing), and security validation work such as auditing password-policy enforcement and generating compliance trails. The private-key spraying scenario — testing a found key against common usernames across a discovered SSH fleet — is the kind of capability that cuts both ways, which is precisely why it belongs in authorized scopes with explicit rules of engagement.
For defenders, brutus is a useful purple-team reference: every authentication attempt it makes lands in standard service logs, so SSH brute-force detections, database login-failure alerting, Windows 4625 events, and Kerberos enumeration monitoring all apply. Teams hardening environments can run it against their own ranges to verify that default-credential checks, lockout policies, and bad-key rotations actually hold. With 324 stars, an Apache-2.0 license, and active maintenance from a well-known security firm, brutus is a credible, well-engineered entry in the credential-testing space — handle it with the same scope discipline you would apply to anything that shakes authentication handlers at scale.
praetorian-inc/brutus.Educational analysis for authorized security professionals. Use only in controlled, authorized environments.
Related coverage
0 comentários:
Post a Comment
Note: Only a member of this blog may post a comment.