Medusa Parallel Network Login Auditor :: Feature Comparison

JoMo-Kun / jmk "AT" foofus "DOT" net

Information contained on this page for Hydra and Ncrack is primarily based on their own documentation. In several cases, these tools were compared in real world situations and their results have been noted. For example, Hydra 7.1 mentions IMAP support, but tests against Exchange 2010 resulted in errors or incorrect findings.

Area Feature Medusa 2.1 Hydra 7.1 Ncrack 0.4ALPHA
* License GPL-2 GPL-3 GPL-2
Core Parallel Method pthread fork()
Service Design Modular Built-in
Speed (several comparisons are included below) ? ? ?
Generic Wrapper Module
AFP
CVS
FTP FTP
Explicit FTPS (AUTH TLS Mode as defined in RFC 4217) [2]
Implicit FTPS (FTP over SSL (990/tcp) Broken [3]
HTTP Basic Auth √ [4]
NTLM Auth (Windows Integrated) Broken [5]
Digest Authentication MD5, MD5-sess Broken [6]
HTTP Proxy
ICQ
IMAP Method AUTH-LOGIN Support Broken [1]
Method AUTH-PLAIN Support Broken [1]
Method AUTH-NTLM Support
SSL Support IMAPS, STARTTLS IMAPS, STARTTLS
LDAP
Microsoft SQL Port Auto-Detection
MS-SQL
MySQL Pre-4.1 Authentication
Pre-4.1 Hash Passing
4.1+ Authentication
NCP (NetWare) √ (ncpfs) √ (ncpfs)
NNTP √ (Original AUTHINFO) √ (Original AUTHINFO)
Oracle Database √ (via Wrapper script) Broken
Listener Broken [10]
SID
PcAnywhere Supported Encryption Level None None
Supported Authenication Mode(s) Native PCA, ADS, NT, Windows Native PCA
PCNFS
POP3 Method AUTH-USER Support Broken [7]
Method AUTH-LOGIN Support Broken [7]
Method AUTH-PLAIN Support Broken [7]
Method AUTH-NTLM Support Broken [7]
SSL Support POP3S, STARTTLS POP3S [8] POP3S, STARTTLS
PostgreSQL
RDP (Terminal Server √ (via Wrapper Script)
REXEC
RLOGIN .rhost Support
Password Support
RSH
SAPR3
SIP
SMB (Microsoft Windows/Samba) Authentication Modes clear-text, LMv1, NTLMv1, LMv2, NTLMv2 clear-text, LMv1, NTLMv1, LMv2, NTLMv2 Broken [11]
Hash Passing
SMTP Method AUTH-LOGIN Support
Method AUTH-PLAIN Support
Method AUTH-NTLM Support
SSL Support STARTTLS
VRFY
SNMP √ (significantly faster design) √ (overwrites sysName with "HYDRA")
SOCKS5
SSHv2 √ (libssh2) √ (libssh)
SVN
TeamSpeak
Telnet Generic Telnet
Cisco (AAA/non-AAA) Broken [9]
Cisco enable password
AS/400 (TN5250) Support
VNC Password-less/Password-only Support
Anti-Brute Force Slowdown Support
Username/Password Support
VmWare Authentication Daemon Non-SSL Authentication
SSL Authentication
Web Form Module

[1] Failed test cases: 
  Exchange 2010 (LOGIN/valid credentials): [ERROR] IMAP LOGIN AUTH : 4 BAD Command Argument Error. 11 
  Exchange 2010 (PLAIN/valid credentials): [ERROR] IMAP LOGIN AUTH : 4 BAD Command Argument Error. 11 
    * Note: Some attempts simply terminated suggesting the correct password was not found. In some cases,
      re-running the same command would respond with one of the above errors.
  
  Dovecot (PLAIN/valid credentials): "Unsupported authentication mechanism."

[2] Test case: Ubuntu 11.10 vsftpd 2.3.2 TLSv1 (AUTH TLS/SSL) - Hydra/Ncrack both failed to find known valid credentials.
[3] Test case: Ubuntu 11.10 vsftpd 2.3.2 TLSv1 - Hydra: [ERROR] TLS negotiation failed 530
[4] Base64 previously incorrect for certain passwords (status of fix is uncertain)
[5] Test case: Windows 2003 IIS 6.0/2008 IIS 7.0 Integrated Auth - hydra: ntlm.c:1178: unicodeToString: Assertion `len + 1 < sizeof buf' failed 
[6] Test case: Windows 2008 IIS 7.0 Digest - Failed to identify correct password
[7] Test case: Exchange 2010 - STLS implementation appears broken
[8] Test case: Exchange 2010 - Failed to identify correct password
[9] Cisco with Username: prompt - Failed to identify correct password
[10] Test case: Oracle 11g - Failed to identify correct password
[11] Test case: Windows 2003 - Infinite loop on single password check

Speed comparison: password list of 20 entries (valid entry at #20)
FTP / Ubuntu 11.10 vsftp 2.3.2
        [1 task]    [4 tasks]    [16 tasks] 
Medusa  1:03.53     15.727         7.658     (e.g., -t 16)
Hydra     57.527    16.545         8.013     (e.g., -t 16)
Ncrack  1:00.01     24.017        15.009     (e.g., -g cl=16,CL=16)

Speed comparison: password list of 1003 entries (valid entry at #1000)
HTTP / Windows 2008 IIS 7.0
        [1 task]    [4 tasks]    [16 tasks] 
Medusa  1.390       0.803        0.626       (e.g., -v 4 -t 16)
Hydra   1.443       0.855        0.790       (e.g., -t 16)
Ncrack  3.108       3.016        3.013       (e.g., -g cl=16,CL=16)

Speed comparison: password list of 1003 entries (valid entry at #986)
SMB / Windows 2008 
        [1 task]    [4 tasks]    [16 tasks] 
Medusa  6.859       0.919        0.500       (e.g., -v 4 -t 16)
Hydra   8.216                                (doesn't handle parallel connections)
Ncrack                                       (failed to auth to test server) 

Speed comparison: password list of 10 entries (valid entry at #10)
SSH Ubuntu 11.10 OpenSSH 5.8p1
        [1 task]    [4 tasks]    [16 tasks] 
Medusa  38.039      11.943       8.067       (e.g., -v 4 -t 16)
Hydra   32.122      12.208       8.457       (e.g., -t 16)
Ncrack  30.023      27.012       24.013      (e.g., -g cl=16,CL=16)


Medusa Documentation