Medusa Login Brute-ForcerStep-by-step reference: audit lab logins in parallel with Medusa modules. Lab only.FAQ

What is Medusa?

Medusa is a free, open-source network login brute-forcer on Kali. It tests credential combinations in parallel threads against SSH, FTP, HTTP forms, SMB, databases, and more through protocol modules.

Is using Medusa legal?

Medusa itself is legitimate auditing software. Brute-forcing logins without explicit written permission is illegal and locks accounts. Use it only on lab machines or signed engagements with agreed lists and thresholds.

How do I install Medusa?

It ships with Kali. Elsewhere run sudo apt install medusa -y, then medusa -d to list every protocol module available.

How do I audit lab SSH?

Run medusa -h against the lab IP with -u, -P, -M ssh, and -t 4. Keep lists tiny, watch for lockouts, and stop at agreed attempt counts.

How do web form audits work?

Map the form with -m including path, ^USER^ and ^PASS^ fields, and the F= failure string from a manual bad login. Medusa replays the form per password.

What is the difference between Medusa and Hydra?

Both brute-force logins. Hydra covers more protocols with simpler syntax; Medusa offers fine thread control and combo-file flexibility. Labs often keep both ready.

Why did accounts lock out?

Too many guesses tripped the policy. Stop, confirm the threshold, shrink lists drastically, and resume only inside the agreed window — if at all.

How do defenders stop brute force?

SSH keys instead of passwords, fail2ban rate limiting, account lockouts with alerting, MFA everywhere, and no exposed management logins.

All tools · Sitemap · Games