Legba is a multiprotocol credentials bruteforcer / password sprayer and enumerator built with Rust and the Tokio asynchronous runtime in order to achieve better performances and stability while consuming less resources than similar tools (see the benchmark page).
- Installation
- Usage
- Recipes
- REST API
- Model Context Protocol (MCP)
- Benchmark
- Plugins
- AMQP (ActiveMQ, RabbitMQ, Qpid, JORAM and Solace)
- DNS (subdomain enumeration)
- FTP
- HTTP (basic auth, pages and virtual hosts enumeration, login forms with CSRF, NTLMv1 and NTLMv2 authentication)
- IMAP
- IRC
- Kerberos
- LDAP
- MongoDB
- MQTT
- Microsoft SQL
- MySQL
- Oracle
- Port Scanner (TCP & UDP with banner grabbing)
- PostgreSQL
- POP3
- RDP
- Redis
- Samba (Authentication and Shares enumeration)
- ScyllaDB / Cassandra
- SSH / SFTP
- SMTP
- SNMP v1/v2/v3
- SOCKS5
- STOMP (ActiveMQ, RabbitMQ, HornetQ and OpenMQ)
- Telnet
- VNC
- Custom Binary (for password protected files and anything with a CLI)