0

I want to find the username first, then pass the username and a password list. I could not find flags to ignore password in Ncrack and other related tools. The device I want to find a username is Linux based. Is there a tool to identify the username only? EDIT: SSH access is needed.

  • 3
    Does this system give a different response when you type a valid username versus an invalid username? If not, you won't be able to guess the username/password pair independently. – PwdRsch Apr 24 at 16:08
  • No, it does not give a different response. – tyler durden Apr 24 at 16:19
1

If the system doesn't return a different response when you try to log in using a username, then in that case no, there's no way to see if the username you just tried is valid or not (if it exists, if it's enabled, etc). In that case, if you want to go at it the good old "bruteforce" way, you'll have to use lists of common usernames and passwords, and throw them at the login form.

As stated by @Rasool Ziafaty, doing a bit of recon about the system you're trying to bruteforce your way in can go a long way. Maybe use credentials from data leaks of services that are related to the one you're logged in, or using certain usernames or passwords that are more likely to be used on that specific system (ie: using Anime character names in usernames and passwords if you try to bruteforce a login form for an Anime forum).

This is why the reconnaissance phase in hacking is important and can be the longest one, because before attacking, you need to know what you're going to be dealing with.

0

You forgot to say what is the protocol you want to brute force for example ssh or web-login form, but in general you can't do that in most modern logins cause they don't give you any response if username is valid or invalid, you must do information gathering phase before any password attack, or try to brute force username and password together to get valid response.

  • 1
    I guess I must try standard usernames manually, before a username list – tyler durden Apr 24 at 16:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.