// the take
Ncrack is the Nmap project's network authentication cracker: a command-line brute-forcer that speaks a long list of protocols (SSH, RDP, SMB, MySQL, MongoDB, Redis, WinRM, and more) using an Nmap-like target/timing syntax. It's aimed at pentesters and sysadmins who need to credential-test a fleet of hosts rather than hand-roll a script per protocol.
Protocol breadth is genuinely unusual for this category — one binary covers everything from legacy Telnet/FTP to SMB2, MongoDB, Cassandra and MQTT instead of forcing you to juggle a dozen single-purpose crackers. The dynamic engine adjusts bruteforce behavior based on connection feedback (timeouts, resets) instead of blindly hammering at a fixed rate, which matters when you're auditing production infrastructure you don't want to knock over. CLI and runtime interaction deliberately mirror Nmap's, so anyone who already knows nmap/nping gets a shallow learning curve, and there's an actual developer guide for writing new protocol modules rather than just 'read the source.'
Last push was April 2024, so for an actively-attacked surface like credential testing, SSH/RDP/SMB protocol quirks, new auth extensions, lockout behaviors — introduced since then aren't accounted for. It vendors its own OpenSSH and OpenSSL code (there's a whole mswin32/OpenSSL tree with prebuilt 1.1-series DLLs) rather than linking the system crypto libs, which means CVEs in those libraries don't get fixed by patching your OS; you're dependent on upstream Ncrack to rebuild and ship. It's a single-process, single-host tool with no clustering or distributed-run story, so 'large-scale auditing of multiple hosts' is relative — you're bottlenecked by one machine's connection throughput at real scale. And several of the less common modules (DICOM, CVS, SIP) see far less real-world usage than SSH/RDP/SMB, so expect them to be thinner on edge-case handling and testing.
We read the README, the directory tree and a key source file in October 2026. Nobody pays to be listed. How we judge →