root@thehacksparrow:~/writeups$ SYSTEM ONLINE
· log in sign up
← back to cheatsheets
root@sparrow:~/writeups$ cat medusa.md
// cracking

Medusa

21 Jul 2026 · 6 min read
crackingcheatsheetsmedusa
Medusa is a modular, parallel brute-force login cracker that tests credentials against network services such as ssh, ftp, http, smbnt, rdp, or databases. Its strength is firing many simultaneous attempts against one or several hosts at once, each service through its own module (-M).

Medusa parallelizes along two axes at once: -t opens several threads against a single host and -T tests several hosts in parallel, so the number of simultaneous connections is the product of both. Grasping that multiplication is key to avoid saturating the network or triggering account lockouts. Combo files (-C) let you test specific user:password pairs instead of the cartesian product of -U by -P.

1. Beginner level — services and wordlists

MEDUSA cheat sheet — Beginner
CommandWhat it does
medusa -h <ip> -u user -P <wl> -M sshSSH brute force
medusa -h <ip> -U users -p pass -M ftpFTP with a fixed password
medusa -h <ip> -U users -P <wl> -M sshCombined users and passwords
medusa -H hosts.txt -u user -P <wl> -M sshMultiple hosts
medusa -h <ip> -u user -P <wl> -M ssh -O out.txtSaves the result
medusa -h <ip> -u user -P <wl> -M ssh -t 4Threads per host
medusa -h <ip> -u admin -P <wl> -M http -m DIR:/loginBrute-forces an HTTP login
medusa -h <ip> -U users -P <wl> -M mysqlMySQL
medusa -h <ip> -u admin -P <wl> -M rdpRDP
medusa -h <ip> -u user -P <wl> -M smbntSMB
medusa -dLists the available modules
medusa -h <ip> -u user -P <wl> -M ssh -fStops at the first hit (per host)
medusa -h <ip> -u user -P <wl> -M ssh -v 6Verbosity level
medusa -M ssh -qShows the module's parameters

2. Advanced level — combos, parallelism, and forms

MEDUSA cheat sheet — Advanced
CommandWhat it does
medusa -h <ip> -C combos.txt -M sshCombined user:password list
medusa -H hosts.txt -u user -P <wl> -M ssh -T 10Hosts in parallel
medusa -h <ip> -u user -P <wl> -M ssh -FStops after the first global hit
medusa -h <ip> -u admin -P <wl> -M web-form -m FORM:'user=&pass='Brute-forces a web form
medusa -h <ip> -u user -P <wl> -M ssh -e nsTries empty and username=password
medusa -h <ip> -u user -P <wl> -M ssh -r 3 -R 2Retries on network failure
medusa -h <ip> -U users -P <wl> -M ssh -n 2222Non-standard port
medusa -h <ip> -u administrator -P <wl> -M smbnt -m GROUP:DOMAINSMB with domain
medusa -h <ip> -u user -P <wl> -M ssh -bWithout startup banner
medusa -h <ip> -u user -P <wl> -M ssh -sForces SSL
medusa -h <ip> -u user -P <wl> -M postgresPostgreSQL
medusa -h <ip> -u user -P <wl> -M vncVNC
medusa -h <ip> -u user -P <wl> -M telnetTelnet
medusa -h <ip> -u user -P <wl> -M ssh -O log.txt -v 4Detailed log to file

3. Details people miss

  • Don't confuse -t (threads per host) with -T (hosts in parallel): the total of simultaneous connections is the product of both, and setting it too high saturates the network or triggers lockouts.
  • -f stops at the first hit per host; -F stops the whole run at the first global hit. They are different things.
  • Before building the -m for http or web-form, run medusa -M <module> -q to see the exact parameters that module accepts (FORM, DIR…).
  • -H expects a host file, not a bare IP; for a single target use -h. Mixing them causes the input to be ignored.
  • Account lockout is real: SSH, SMB, or RDP often lock after a few failures. Lower the threads and use -r/-R for network retries instead of hammering.

Responsible use

These commands are for systems you own or have explicit written authorisation to test (labs, CTFs, contracted engagements). Using them against third-party infrastructure without permission is illegal in most countries.