medusa: Fast network brute-forcing tool

Medusa is a speedy, massively parallel, modular login brute-forcer, created by the Foofus.net team as a direct alternative to Hydra. Like Hydra, it can attack many different network services, but it was designed from the ground up around a clean, thread-based, modular architecture (each protocol is a separate .mod shared library), which makes it easy to extend and, according to its authors, more stable under heavy parallel load.

Medusa supports thread-per-host parallelism, meaning it can brute-force multiple hosts and multiple usernames simultaneously, each in its own thread, rather than serializing across targets. It ships with modules for services including SSH, FTP, Telnet, HTTP, SMB, MS-SQL, MySQL, PostgreSQL, POP3, IMAP, VNC, PcAnywhere, Rlogin, SNMP, SVN, VMware Authentication Daemon, Web Form, and more.

Key Features

• Thread-based parallel testing of multiple hosts, users, or passwords at once
• Modular design (.mod files) — new protocols can be added without recompiling the core
• Flexible input: single or list-based users/passwords, combined with wildcards
• Can resume/stop early once valid credentials are found
• Non-blocking, resumable network I/O for stability on large host lists

Installation

Medusa is preinstalled on Kali Linux. To install/update manually:

sudo apt update
sudo apt install medusa -y

Verify installation and list available modules:

medusa -d

Building from source:

git clone https://github.com/jmk-foofus/medusa.git
cd medusa
./configure
make
sudo make install

Syntax

medusa -h HOST|-H FILE -u USER|-U FILE -p PASS|-P FILE -M MODULE [options]

Command-Line Options

Basic Usage

medusa -h 192.168.1.10 -u admin -P /usr/share/wordlists/rockyou.txt -M ssh

Expected output:

Medusa v2.2 [http://www.foofus.net] (C) JoMo-Kun / Foofus Networks <jmk@foofus.net>

ACCOUNT CHECK: [ssh] Host: 192.168.1.10 (1 of 1, 0 complete) User: admin (1 of 1, 0 complete) Password: 123456 (1 of 14344399 complete)
ACCOUNT CHECK: [ssh] Host: 192.168.1.10 (1 of 1, 0 complete) User: admin (1 of 1, 0 complete) Password: password (2 of 14344399 complete)
ACCOUNT FOUND: [ssh] Host: 192.168.1.10 User: admin Password: summer2023 [SUCCESS]

Practical Examples

Example 1 — Basic SSH brute-force

medusa -h 10.10.10.5 -u sysadmin -P rockyou.txt -M ssh -t 4

ACCOUNT FOUND: [ssh] Host: 10.10.10.5 User: sysadmin Password: letmein123 [SUCCESS]

Example 2 — Multiple hosts and users from files

medusa -H hosts.txt -U users.txt -P passwords.txt -M ftp -t 8 -T 4

ACCOUNT FOUND: [ftp] Host: 10.10.10.20 User: ftpuser Password: welcome1 [SUCCESS]
ACCOUNT FOUND: [ftp] Host: 10.10.10.21 User: backup Password: Backup2020 [SUCCESS]

Example 3 — RDP brute-force with connection timeout

medusa -h 10.10.10.40 -u helpdesk -P passwords.txt -M rdp -g 5 -r 3

ACCOUNT FOUND: [rdp] Host: 10.10.10.40 User: helpdesk Password: Welcome2024 [SUCCESS]

Example 4 — MySQL root password test with stop-on-success

medusa -h 10.10.10.70 -u root -P common-mysql-passwords.txt -M mysql -f

ACCOUNT FOUND: [mysql] Host: 10.10.10.70 User: root Password: toor [SUCCESS]

Example 5 — Web form brute-force

medusa -h 10.10.10.30 -u admin -P rockyou.txt -M http \
  -m FORM:"/login.php:username=&password=&Login=Login:F=Invalid credentials"

ACCOUNT FOUND: [http] Host: 10.10.10.30 User: admin Password: P@ssw0rd! [SUCCESS]

Example 6 — Combo file attack (host:user:pass)

medusa -C combos.txt -M ssh

ACCOUNT FOUND: [ssh] Host: 10.10.10.5 User: root Password: toor123 [SUCCESS]

Example 7 — Verbose output for debugging

medusa -h 10.10.10.5 -u admin -P small.txt -M ssh -v 5

[DEBUG] Establishing connection to 10.10.10.5:22
[DEBUG] Sending credentials admin:123456
[DEBUG] Server response: Authentication failed
[DEBUG] Sending credentials admin:admin123
ACCOUNT FOUND: [ssh] Host: 10.10.10.5 User: admin Password: admin123 [SUCCESS]

Example 8 — Non-default SSH port

medusa -h 10.10.10.5 -u admin -P passwords.txt -M ssh -n 2222

ACCOUNT FOUND: [ssh] Host: 10.10.10.5 User: admin Password: Sp1cyTaco! [SUCCESS]

Common Use Cases

• Parallel credential testing across an entire subnet or host list (-H + -T)
• SSH/FTP/RDP weak-credential audits during internal penetration tests
• Testing web application login endpoints for weak/default passwords
• Verifying database service (MySQL/MSSQL/PostgreSQL) default credentials
• Second-opinion / cross-validation tool alongside Hydra to confirm findings

Automation with Bash

#!/bin/bash
# medusa-sweep.sh — brute force SSH across a list of hosts, one result file per host
while read -r host; do
  echo "[*] Testing $host"
  medusa -h "$host" -U users.txt -P passwords.txt -M ssh -t 4 -O "medusa_${host}.log"
done < hosts.txt

#!/bin/bash
# medusa-multi-module.sh — test the same creds against several services
HOST="10.10.10.5"
for mod in ssh ftp telnet; do
  medusa -h "$HOST" -u admin -P passwords.txt -M "$mod" -f -O "medusa_${mod}.log"
done

Tips and Best Practices

• Use -T to spread load across many hosts in parallel rather than only increasing -t (per-host threads) — this is much faster for subnet-wide sweeps.
• Set -g (timeout) and -R (retries) explicitly on unreliable networks/VPNs to avoid false negatives from dropped connections.
• Use -f/-F in large sweeps so Medusa doesn’t waste time continuing to brute-force a host once valid creds are already found.
• Run medusa -d first to confirm exactly which modules and their options are available in your installed version — module option syntax (-m) varies by protocol.
• Combine -e ns with a short password list first — many internal services still use blank or username-as-password credentials.

Troubleshooting

References

• Official site: http://www.foofus.net/?page_id=51
• GitHub: https://github.com/jmk-foofus/medusa
• Kali Linux tool page: https://www.kali.org/tools/medusa/
• Man page: man medusa