Brutespray is a fast, multi-protocol credential brute-forcer for penetration testers and red teams that automatically tests default and custom credentials across dozens of services directly from scanner output.

What it is

Brutespray is a command-line security tool written in Go, created by Shane Young (@x90sky) and Jacob Robles (@shellfail) and inspired by Leon Johnson (@sho-luv). It lives in the offensive-security and network-security ecosystem alongside tools such as Nmap, Nessus, and Nexpose, and it ships as a single static binary (version 2.7.2) under the MIT licence with an interactive terminal UI, embedded wordlists, and checkpoint-based resume support.

The concrete problem it solves is the manual translation between service discovery and credential testing. Rather than reading scan results by hand and invoking a separate attacker for each host, you feed Brutespray your existing scan output in Nmap GNMAP/XML, Nessus, Nexpose, JSON, or plain list format, and it parses the discovered services itself and attacks them in parallel across 40+ protocols. It replaces the repeated, per-service invocation of individual brute-force tools with one pass over a scan file, targeting the exact host, port, and service combination that was actually observed.

Key capabilities

• Imports Nmap GNMAP/XML, Nessus, Nexpose, JSON, and plain list formats, and can also be fed over pipeline stdin from tools such as naabu, fingerprintx, and masscan.
• Brute-forces 41 services including ssh, ftp, telnet, smtp, imap, pop3, mysql, postgres, mssql, mongodb, redis, vnc, snmp, smbnt, rdp, http, ldap, winrm, and oracle.
• Runs a lockout-aware password spray mode with configurable delays, alongside standard parallel credential attempts with dynamic threading, a circuit breaker, and rate limiting.
• Supports HTTP Basic/Digest/NTLM (auto and forced modes), SMTP PLAIN/LOGIN, IMAP/POP3 SASL, and SMB pass-the-hash, with per-module settings passed via -m KEY:VALUE.
• Provides an interactive TUI with tabbed Findings and live settings views, plus pause-and-resume of individual hosts, and Ctrl+C checkpointing that can be resumed later.
• Emits summary reports as JSON, CSV, Metasploit RC, and NetExec scripts, with per-attempt JSONL output.
• Ships embedded wordlists compiled into the binary through a layered manifest system, and routes traffic through a SOCKS5 proxy with authentication.

Who uses it and how

• Penetration testers who have already run an Nmap, Nessus, or Nexpose engagement feed the saved scan file straight into brutespray -f nmap.gnmap -u admin -p password to test every discovered service in one pass.
• Red-team operators working through a CIDR range use invocations such as -H ssh://10.1.1.0/24:22 -u root -p passlist.txt, or supply combo credentials with -C root:root for known username/password pairs.
• Assessments against environments with account lockout policies run the spray mode with configured delays rather than unrestricted parallel attempts.
• Operators working through proxies route attempts through an authenticated SOCKS5 proxy, and long engagements interrupt with Ctrl+C and resume from the checkpoint rather than restarting.
• Teams standardising output import results into Metasploit RC files or NetExec scripts for follow-on tooling.

Getting started

Install it with go install github.com/x90skysn3k/brutespray/v2@latest, or use the release binaries and the Docker instructions documented in docs/installation.md.

How it compares

Brutespray sits alongside hydra, medusa, ncrack, and brutus as a service-credential attacker, but it differs on the workflow features those tools document as absent: a single static binary with an interactive TUI, checkpoint/resume, lockout-aware spray mode, per-attempt JSONL output, and import from Nmap GNMAP/XML, Nessus, and Nexpose. Its 41 supported services sit below hydra's 50+ but above medusa (34), ncrack (14), and brutus (23), and the README notes that competing tools change quickly and that comparison symbols reflect documented behaviour at PR time.

When to use it — and when not

It suits operators who already have scanner output and want one binary to turn it into credential tests, particularly where checkpointing, spraying, and proxy support matter. It is the wrong choice if you need coverage of services outside its 41 supported protocols — hydra supports more — and note that the project carries 14 open issues, so expect some rough edges rather than a fully polished tool.

go install github.com/x90skysn3k/brutespray/v2@latest

# From Nmap scan output
brutespray -f nmap.gnmap -u admin -p password

# Target a specific host
brutespray -H ssh://192.168.1.1:22 -u admin -p passlist.txt

# CIDR range
brutespray -H ssh://10.1.1.0/24:22 -u root -p passlist.txt

# Combo credentials
brutespray -H ssh://10.0.0.1:22 -C root:root