2

I'm conducting some basic pen testing against a page protected with Basic Authentication. I've sucessfully tested with Medusa and Hydra but am struggling to get the syntax correct for ncrack.

The syntax I have been using usually gives the following error (which I am not entirely sure what it means)

Starting Ncrack 0.4ALPHA ( http://ncrack.org ) at 2014-05-10 13:37 EDT
Failed to resolve given hostname/IP: . Note that you can't use '/mask' AND '1-4,7,100-' style IP ranges*

the web page is hosted on a local vm pointing to the webpage /~alice/secret/

ncrack -m http -U users -P adobe25 http://webserver_ip -path /~alice/secret/

Any help on explaining/fixing this syntax would be greatly appreciated.

3
  • just in case you copy paste that command line, you did realise you've missed the leading h off the URL? May 10 '14 at 19:47
  • Hi Rory, yeah I did, it was throwing errors at me saying that I couldn't post more than 2 links, so I dropped the 'http' down to 'ttp' - I should have mentioned that. Thanks :)
    – user46352
    May 11 '14 at 11:46
  • pretty sure you don't put http as the target. You would just put the hostname (or IP addr/prefix) and then use -p <port number>
    – atdre
    Oct 10 '14 at 15:26
5

The path option needs to be used in conjunction with the -g (global) or -m (module-specific) option, like so:

ncrack -m http -U users -P adobe25 http://webserver_ip -g path=/~alice/secret/

Please note, however, that Ncrack is not maintained. You would probably be better off using Nmap's http-brute script. From the Ncrack web page:

Deprecation Notice: Ncrack was written as a "Google Summer of Code" Project in 2009. While it is useful for some purposes, it is unfinished, alpha quality software and isn't currently maintained. Instead, we generally recommend the brute force scripts included as part of Nmap's Scripting Engine (NSE).

EDIT: In spring of 2016, Ncrack's primary author Ithilgore began work again on Ncrack. It is again under active development on Github.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.