Legba

legba

legba is a fast, multi-protocol credential bruteforcer, password sprayer, and enumerator written in Rust on top of the Tokio async runtime. It is a modern replacement for THC-Hydra, Medusa, Ncrack, and Patator — benchmarked at 4.5× faster on HTTP basic auth, 55× faster on SSH, 3.8× on MySQL vs. Hydra on identical hardware. It ships as a single static binary with no native dependencies and supports 30+ protocol plugins.

Full documentation: https://legba.evilsocket.net/ GitHub: https://github.com/evilsocket/legba

Installation

# Precompiled binary (Linux/macOS) — recommended
# Download the latest release from https://github.com/evilsocket/legba/releases

# Homebrew (macOS / Linux)
brew tap evilsocket/legba https://github.com/evilsocket/legba
brew install legba

# Cargo
cargo install legba

# Docker
docker run ghcr.io/evilsocket/legba [args]

Full install instructions: https://legba.evilsocket.net/install/

Core Concepts

Target Syntax

Credential Expression Syntax

Credentials (username, password, payload) are flexible expressions, not just plain wordlist paths.

Iteration Modes

By default legba iterates over passwords for each username. Change with --iterate (-I):

-I user      # iterate over usernames for each password (password spray)
-I password  # default: iterate over passwords for each username (brute-force)

Key CLI Options

Full usage reference: https://legba.evilsocket.net/usage/

Supported Plugins

Before generating a command for a specific plugin, fetch its documentation page to get the correct flags and examples.

Recipe System

Recipes are YAML files that define reusable, parameterized attack configurations. They support variable substitution ({$var or default}) and resource embedding relative to the recipe path.

legba --recipe attack.yaml
# Override recipe variables at runtime:
legba --recipe attack.yaml --set target=192.168.1.1 --set wordlist=passwords.txt

Recipes are ideal for complex flows: CSRF token grabbing, multi-step auth, custom headers, or repeatable pentest engagements.

Full recipe reference and examples: https://legba.evilsocket.net/recipes/

REST API

Start an HTTP API alongside an attack session to query status, list running sessions, and stop them programmatically:

legba http.basic --target example.com --username admin --password @pass.txt --api 127.0.0.1:8080

Full REST API reference: https://legba.evilsocket.net/rest/

MCP Server

legba is the only credential bruteforcer with a built-in Model Context Protocol (MCP) server, allowing AI agents to drive it programmatically:

# SSE mode (Claude Desktop, Cline, etc.)
legba --mcp 127.0.0.1:9090

# stdio mode (local agent pipelines)
legba --mcp stdio

Full MCP setup and agent configuration snippets: https://legba.evilsocket.net/mcp/

Session Management

Save progress and resume interrupted attacks:

# Start with session tracking
legba ssh --target 10.0.0.1 --username root --password @pass.txt --session /tmp/my.session

# Resume later (same command, session file is detected automatically)
legba ssh --target 10.0.0.1 --username root --password @pass.txt --session /tmp/my.session

Where to Look for More

• FAQ and common attack recipes: https://legba.evilsocket.net/faq/
• Speed comparison vs. Hydra/Medusa/Ncrack: https://legba.evilsocket.net/comparison/
• Reproducible benchmarks: https://legba.evilsocket.net/benchmark/
• Full documentation index: https://legba.evilsocket.net/