Brute Force Modules
Relevant source files
The following files were used as context for generating this wiki page:
Brute Force Modules in OWASP Nettacker are specialized automated components designed to test for weak credentials across various network protocols and services. These modules are a core part of the framework's modular architecture, allowing users to perform automated penetration testing and network security audits by systematically attempting to gain access through credential testing.
The modules support a wide range of protocols, including SSH, FTP, FTPS, and web-based interfaces like WordPress XML-RPC. They utilize multithreaded execution to enhance scanning speed and can be configured with custom wordlists or built-in defaults to identify vulnerabilities related to default or weak authentication.
Sources: README.md:21-25, README.md:43-46, nettacker/lib/readme.md:7-10
Module Architecture and Logic
Nettacker's brute force modules follow a YAML-based configuration structure that defines the service metadata, the library to be used, and the specific payloads for the attack. Each module is categorized under specific "profiles" (e.g., brute, ftp, ssh) which allows the engine to group and execute related tasks together.
Configuration Structure
Each module defines an info block for metadata and a payloads block for execution logic. The logic typically involves a brute_force method provided by a backend library.
The diagram shows the workflow from profile selection to credential validation across different service modules.
Sources: nettacker/modules/brute/ssh.yaml:1-25, nettacker/modules/brute/ftp.yaml:1-20, nettacker/modules/brute/ftps.yaml:1-20
Protocol-Specific Implementations
Brute force modules are tailored for specific services by defining unique port ranges, default usernames, and validation conditions.
Network Service Modules
Modules like SSH and FTP target standard ports and common administrative accounts.
| Module | Default Ports | Common Usernames | Library |
|---|---|---|---|
| SSH Brute | 22, 2222 | root, admin, user, test | ssh |
| FTP Brute | 21 | root, admin, user, test, anonymous | ftp |
| FTPS Brute | 990 | root, admin, user, test, anonymous | ftps |
Sources: nettacker/modules/brute/ssh.yaml:14-22, nettacker/modules/brute/ftp.yaml:14-22, nettacker/modules/brute/ftps.yaml:14-22
Web-Based Brute Force
The framework also supports application-level brute forcing, such as attacking the WordPress XML-RPC interface. Unlike network modules, these use the http library and send XML payloads via POST requests.
The sequence shows how the WordPress XML-RPC brute force module interacts with the target using HTTP methods.
Sources: nettacker/modules/vuln/wp_xmlrpc_bruteforce.yaml:14-43
Payload and Fuzzing Logic
Nettacker uses a specialized fuzzer configuration within the YAML files to handle credential lists. The nettacker_fuzzer component can read from files or process inline lists.
Fuzzer Components
- input_format: Defines how the password/username is injected into the request.
- data: Specifies the source of the wordlist, often using
read_from_file. - interceptors: (Optional) Functions used to process or transform data before the request.
Sources: nettacker/modules/brute/ssh.yaml:26-34, nettacker/modules/vuln/wp_plugin_cve_2021_38314.yaml:26-34
Success Condition Validation
Modules determine a successful login through a response block. For network protocols like FTP or SSH, this is often handled by a library-specific successful_login condition. For web modules, it uses regex matching against the response body or status codes.
response:
condition_type: or
conditions:
successful_login:
regex: ''
reverse: false
Sources: nettacker/modules/brute/ssh.yaml:37-42, nettacker/modules/vuln/wp_xmlrpc_bruteforce.yaml:39-43
Summary
Brute Force Modules provide a standardized, YAML-driven approach to credential testing across diverse services. By leveraging common libraries and a centralized fuzzer, Nettacker enables efficient discovery of weak points in authentication across SSH, FTP, and web applications. These modules are integrated into the core engine's reporting and multithreading systems to provide scalable reconnaissance and vulnerability assessment capabilities.
Sources: README.md:27-30, nettacker/lib/readme.md:7-12