> For the complete documentation index, see [llms.txt](https://cajac.gitbook.io/ctf-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cajac.gitbook.io/ctf-notes/creds/online-attacks/medusa.md).

# Medusa

**Medusa** is intended to be a speedy, massively parallel, modular, login brute-forcer. The goal is to support as many services which allow remote authentication as possible. The author considers following items as some of the key features of this application:

* Thread-based parallel testing. Brute-force testing can be performed against multiple hosts, users or passwords concurrently. 
* Flexible user input. Target information (host/user/password) can be specified in a variety of ways. For example, each item can be either a single entry or a file containing multiple entries. Additionally, a combination file format allows the user to refine their target listing. 
* Modular design. Each service module exists as an independent .mod file. This means that no modifications are necessary to the core application in order to extend the supported list of services for brute-forcing.
* Multiple protocols supported. Many services are currently supported (e.g. SMB,  HTTP, POP3,  MS-SQL, SSHv2, among others).

Add examples...

## Usage information

<details>

<summary>medusa -h</summary>

```bash
┌──(kali㉿kali)-[~]
└─$ medusa -h
Medusa v2.2 [http://www.foofus.net] (C) JoMo-Kun / Foofus Networks <jmk@foofus.net>

medusa: option requires an argument -- 'h'
CRITICAL: Unknown error processing command-line options.
ALERT: Host information must be supplied.

Syntax: Medusa [-h host|-H file] [-u username|-U file] [-p password|-P file] [-C file] -M module [OPT]
  -h [TEXT]    : Target hostname or IP address
  -H [FILE]    : File containing target hostnames or IP addresses
  -u [TEXT]    : Username to test
  -U [FILE]    : File containing usernames to test
  -p [TEXT]    : Password to test
  -P [FILE]    : File containing passwords to test
  -C [FILE]    : File containing combo entries. See README for more information.
  -O [FILE]    : File to append log information to
  -e [n/s/ns]  : Additional password checks ([n] No Password, [s] Password = Username)
  -M [TEXT]    : Name of the module to execute (without the .mod extension)
  -m [TEXT]    : Parameter to pass to the module. This can be passed multiple times with a
                 different parameter each time and they will all be sent to the module (i.e.
                 -m Param1 -m Param2, etc.)
  -d           : Dump all known modules
  -n [NUM]     : Use for non-default TCP port number
  -s           : Enable SSL
  -g [NUM]     : Give up after trying to connect for NUM seconds (default 3)
  -r [NUM]     : Sleep NUM seconds between retry attempts (default 3)
  -R [NUM]     : Attempt NUM retries before giving up. The total number of attempts will be NUM + 1.
  -c [NUM]     : Time to wait in usec to verify socket is available (default 500 usec).
  -t [NUM]     : Total number of logins to be tested concurrently
  -T [NUM]     : Total number of hosts to be tested concurrently
  -L           : Parallelize logins using one username per thread. The default is to process 
                 the entire username before proceeding.
  -f           : Stop scanning host after first valid username/password found.
  -F           : Stop audit after first valid username/password found on any host.
  -b           : Suppress startup banner
  -q           : Display module's usage information
  -v [NUM]     : Verbose level [0 - 6 (more)]
  -w [NUM]     : Error debug level [0 - 10 (more)]
  -V           : Display version
  -Z [TEXT]    : Resume scan based on map of previous scan

```

</details>

<details>

<summary>medusa -M http -q</summary>

```bash
┌──(kali㉿kali)-[~]
└─$ medusa -M http -q
Medusa v2.2 [http://www.foofus.net] (C) JoMo-Kun / Foofus Networks <jmk@foofus.net>

http.mod (2.1) fizzgig <fizzgig@foofus.net> :: Brute force module for HTTP

Available module options:
  USER-AGENT:? (User-Agent. Default: Mozilla/1.22 (compatible; MSIE 10.0; Windows 3.1))
  DIR:? (Target directory. Default "/")
  AUTH:? (Authentication Type (BASIC/DIGEST/NTLM). Default: automatic)
  DOMAIN:? [optional]
  CUSTOM-HEADER:?    Additional HTTP header.
                     More headers can be defined by using this option several times.

Usage example: "-M http -m USER-AGENT:"g3rg3 gerg" -m DIR:exchange/"
Usage example: "-M http -m CUSTOM-HEADER:"Cookie: SMCHALLENGE=YES"

Note: The default behavior of NTLM authentication is to use the server supplied
domain name. In order to target local accounts, and not domain, use the DOMAIN
option to reference the local system: "-m DOMAIN:127.0.0.1".

```

</details>

## Resources

Medusa - Homepage: <http://foofus.net/?page_id=51>

Medusa - Kali Tools: <https://www.kali.org/tools/medusa/>