I am experimenting with ssh bruteforce over my home network using the
ssh-brute nse script. I have a short list of usernames (just 12) but a long list of passwords (1M).
I can't seem to get the
ssh-brute script to run longer than 900 seconds before it terminates and reports:
PORT STATE SERVICE 22/tcp open ssh | ssh-brute: | Accounts: No valid accounts found |_ Statistics: Performed 1556 guesses in 900 seconds, average tps: 1.9 Nmap done: 1 IP address (1 host up) scanned in 903.62 seconds
I've read the docs for
ssh-brute, and for the
unpwdb nse libraries, but I can't see any options or information that might be relevant (though I might have missed something). I have also searched
man nmap, the online docs and googled for information as to why it might be terminating after 900 seconds/15 minutes, but the closest I could find is the description of the
-T5 timing template, which times out an individual host after 15 minutes without reporting any results for that host, which didn't seem to match my problem. Nonetheless, I tried to manually set
--host-timeout 48h, but that doesn't change the behaviour.
Any clues as to what's causing this, and how to get the script to run longer than 900 seconds?