ncrack: High-speed network authentication cracker

Ncrack is a high-speed network authentication cracking tool built by the Nmap project team, designed specifically to help companies audit their own network device and service credentials at scale. Unlike Hydra and Medusa, which grew organically to support many protocols, Ncrack was engineered with a strong focus on reliability at scale and Nmap-style scripting syntax, making it particularly good for large enterprise audits (e.g., testing thousands of RDP or SSH endpoints for weak/default passwords).

Ncrack uses an Nmap-like command-line syntax and timing templates (-T0 through -T5), and it supports a “grammar” file format for defining custom authentication modules. It natively understands RDP, SSH, Telnet, HTTP(S), POP3(S), IMAP(S), SMB, VNC, FTP, and a few others, with RDP and SSH being particularly well optimized (RDP brute-forcing especially is one of Ncrack’s standout strengths, since it correctly handles NLA in many configurations).

Key Features

• Nmap-style CLI syntax and timing templates for fine control over aggressiveness
• Excellent RDP and SSH module reliability compared to older tools
• Can resume a scan using a saved session state
• Interactive runtime console (press keys during a scan to view stats or change timing)
• Outputs in normal, XML, and “greppable” formats — good for automation pipelines

Installation

Ncrack is included on Kali Linux by default. To install/update:

sudo apt update
sudo apt install ncrack -y

Verify:

ncrack -V

Build from source (latest features):

git clone https://github.com/nmap/ncrack.git
cd ncrack
./configure
make
sudo make install

Syntax

ncrack [options] {target specification}

Target specification generally looks like:

ncrack -p protocol://target[:port] [options]

or protocol options can be passed with -p:

ncrack -p PORT --user USER --pass PASS target

Command-Line Options

Basic Usage

ncrack -p ssh --user admin -P /usr/share/wordlists/rockyou.txt 192.168.1.10

Expected output:

Starting Ncrack 0.7 ( http://ncrack.org ) at 2026-07-19 10:20 UTC
Discovered credentials for ssh on 192.168.1.10 22/tcp:
192.168.1.10 22/tcp ssh: 'admin' 'summer2023'

Ncrack done: 1 service scanned in 45.32 seconds.
Newly discovered credentials for 1/1 services (100%).

Practical Examples

Example 1 — SSH audit with username and password lists

ncrack -p ssh -U users.txt -P passwords.txt 10.10.10.5

Discovered credentials for ssh on 10.10.10.5 22/tcp:
10.10.10.5 22/tcp ssh: 'sysadmin' 'letmein123'

Example 2 — RDP audit against a Windows host (Ncrack’s strongest use case)

ncrack -p rdp --user administrator -P rdp_common.txt 10.10.10.40

Discovered credentials for rdp on 10.10.10.40 3389/tcp:
10.10.10.40 3389/tcp rdp: 'administrator' 'Welcome2024'

Example 3 — Multiple targets from a file with aggressive timing

ncrack -p ssh -U users.txt -P passwords.txt -iL hosts.txt -T4

Discovered credentials for ssh on 10.10.10.5 22/tcp:
10.10.10.5 22/tcp ssh: 'root' 'toor123'
Discovered credentials for ssh on 10.10.10.7 22/tcp:
10.10.10.7 22/tcp ssh: 'backup' 'Backup2020'

Example 4 — Combined credential list (user:pass pairs)

ncrack -p ftp -CL combos.txt 10.10.10.20

Discovered credentials for ftp on 10.10.10.20 21/tcp:
10.10.10.20 21/tcp ftp: 'ftpuser' 'welcome1'

Example 5 — Auditing multiple services on one host

ncrack -p ssh,ftp,rdp -U users.txt -P passwords.txt 10.10.10.5

Discovered credentials for ssh on 10.10.10.5 22/tcp:
10.10.10.5 22/tcp ssh: 'admin' 'admin123'
Discovered credentials for ftp on 10.10.10.5 21/tcp:
10.10.10.5 21/tcp ftp: 'admin' 'admin123'

Example 6 — Saving and resuming a long-running scan

ncrack -p rdp -U users.txt -P rockyou.txt --save rdp_scan.session 10.10.10.40
# ... interrupted with Ctrl+C ...
ncrack --resume rdp_scan.session

[SAVE] Session saved to rdp_scan.session
Resuming session from rdp_scan.session ...
Discovered credentials for rdp on 10.10.10.40 3389/tcp:
10.10.10.40 3389/tcp rdp: 'helpdesk' 'Spring2024!'

Example 7 — Output in all formats for reporting/automation

ncrack -p ssh -U users.txt -P passwords.txt -oA ssh_audit 10.10.10.5

Output saved to ssh_audit.nmap, ssh_audit.xml, ssh_audit.gnmap

Example 8 — Reading targets straight from an Nmap scan

nmap -p 22,3389 -oX scan.xml 10.10.10.0/24
ncrack -iX scan.xml -U users.txt -P passwords.txt

Discovered credentials for ssh on 10.10.10.5 22/tcp:
10.10.10.5 22/tcp ssh: 'sysadmin' 'letmein123'

Common Use Cases

• Large-scale corporate audits of RDP exposure (a very common and high-value finding)
• SSH weak-credential audits across cloud/VPS fleets
• Chaining directly from Nmap discovery scans into credential auditing (-iX)
• Long-running, resumable audits against large IP ranges (--save/--resume)
• Producing machine-parsable output (-oX/-oG) for integration into larger security pipelines

Automation with Bash

#!/bin/bash
# ncrack-full-audit.sh — nmap discovery + ncrack credential audit pipeline
TARGET_RANGE="10.10.10.0/24"

echo "[*] Running Nmap discovery scan..."
nmap -p 22,3389,21,23 -oX /tmp/ncrack_targets.xml "$TARGET_RANGE"

echo "[*] Running Ncrack credential audit..."
ncrack -iX /tmp/ncrack_targets.xml -U users.txt -P passwords.txt -T3 -oA ncrack_results

echo "[*] Audit complete. Results in ncrack_results.*"

#!/bin/bash
# ncrack-rdp-sweep.sh — sweep a list of hosts for weak RDP creds only
while read -r host; do
  ncrack -p rdp --user administrator -P rdp_common.txt "$host" -oN "rdp_${host}.txt"
done < rdp_hosts.txt

Tips and Best Practices

• Use -T3 (Normal, the default) for most engagements; drop to -T1/-T2 on fragile production networks, and only use -T4/-T5 in labs or when explicitly authorized for aggressive testing.
• Ncrack’s RDP module is one of the most reliable in the industry — prefer it over Hydra/Medusa specifically for RDP audits.
• Always use --save on scans expected to run more than a few minutes; network audits get interrupted often (VPN drops, laptop sleep, etc.) and resuming saves huge amounts of time.
• Use -oA by default so you always have normal, XML, and greppable output for reporting without re-running the scan.
• Chain Nmap -oX output directly into ncrack -iX for a clean, repeatable discovery-to-audit pipeline.

Troubleshooting

References

• Official site: https://nmap.org/ncrack/
• GitHub: https://github.com/nmap/ncrack
• Kali Linux tool page: https://www.kali.org/tools/ncrack/
• Man page: man ncrack