How to brute force only username not password?

Question

I want to find the username first, then pass the username and a password list. I could not find flags to ignore password in Ncrack and other related tools. The device I want to find a username is Linux based. Is there a tool to identify the username only? EDIT: SSH access is needed.

Answer 1

If the system doesn't return a different response when you try to log in using a username, then in that case no, there's no way to see if the username you just tried is valid or not (if it exists, if it's enabled, etc). In that case, if you want to go at it the good old "bruteforce" way, you'll have to use lists of common usernames and passwords, and throw them at the login form.

As stated by @Rasool Ziafaty, doing a bit of recon about the system you're trying to bruteforce your way in can go a long way. Maybe use credentials from data leaks of services that are related to the one you're logged in, or using certain usernames or passwords that are more likely to be used on that specific system (ie: using Anime character names in usernames and passwords if you try to bruteforce a login form for an Anime forum).

This is why the reconnaissance phase in hacking is important and can be the longest one, because before attacking, you need to know what you're going to be dealing with.

Answer 2

You forgot to say what is the protocol you want to brute force for example ssh or web-login form, but in general you can't do that in most modern logins cause they don't give you any response if username is valid or invalid, you must do information gathering phase before any password attack, or try to brute force username and password together to get valid response.