Fellow Pen-testers,
After many months of intermittent development, I've decided to release
version 1.0 of Medusa.
What is Medusa? Medusa is a speedy, massively parallel, modular, login
brute-forcer for network services created by the geeks at Foofus.net.
Medusa differs from Hydra in that it supports fewer services, compiles
on less platforms and has a few less options. Hey, it's only version
1.0. It is pthread-based rather than relying on fork(), which should
offer significant performance improvements. It is also modular in design
which should facilitate the creation of new modules. See the Medusa
website for a basic comparison of features.
The following modules are built by default: HTTP, MS-SQL, SMBNT, SSHv2,
Telnet, POP3 and MySQL. The additional modules have been marked as
"untested" and are only built if configure is executed with
"--enable-untested": RSH, RLOGIN, REXEC, FTP, IMAP and the generic
wrapper module.
It should be noted that the SSHv2 module requires libssh2 along with an
included patch to be fully functional. The wrapper module allows the
user to call external programs and scripts and feed credential
information from Medusa to them. A patch to rdesktop has been included
to allow RDP testing via this module.
Medusa was developed on Gentoo Linux and FreeBSD. Some limited testing
has been done on other platforms. If people wish to contribute patches
to fix portability issues, I'd be happy to accept them. There are
probably lots of bugs which have yet to surface. Please let me know if
you encounter issues, fix a bug or just find the application useful.
To download Medusa or view further information on it, visit:
http://www.foofus.net/jmk/medusa/medusa.html
Also celebrating its version 1.0 release today is FgDump. FgDump is a
slick tool created by Fizzgig to wrap CacheDump and PwDump together. It
also manages starting/stopping pesky AV software. For further
information, see: http://www.foofus.net/fizzgig/fgdump/
Happy holidays,
Joe
--
jmk <jmk@foofus.net>
Foofus Networks
------------------------------------------------------------------------------
Audit your website security with Acunetix Web Vulnerability Scanner:
Hackers are concentrating their efforts on attacking applications on your
website. Up to 75% of cyber attacks are launched on shopping carts, forms,
login pages, dynamic content etc. Firewalls, SSL and locked-down servers are
futile against web application hacking. Check your website for vulnerabilities
to SQL injection, Cross site scripting and other web attacks before hackers do!
Download Trial at:
http://www.securityfocus.com/sponsor/pen-test_050831
-------------------------------------------------------------------------------
