Legba
About
Legba is a multiprotocol credentials bruteforcer / password sprayer and enumerator built with Rust and the Tokio asynchronous runtime in order to achieve better performances and stability while consuming less resources than similar tools.
Details
- Author
- evilsocket
- Downloads
- 274
- Categories
- Other
Jump to
- Supports AMQP, Cassandra, DNS, FTP, HTTP, IMAP, IRC, Kerberos, LDAP, MongoDB, MQTT, MSSQL, MySQL, Oracle, PostgreSQL, POP3, RDP, Redis, Samba, SSH, SMTP, Socks5, STOMP, TCP/UDP scanning, Telnet, VNC.
- HTTP features: basic auth, NTLMv1/v2, multipart forms, custom requests with CSRF support, file/folder enumeration, virtual host enumeration.
- MCP server integration since version 0.11.0.
- Asynchronous runtime delivers up to 55x faster performance than hydra on SSH.
Setting up with Highlight
This MCP is not yet compatible with Highlight’s one-click setup. However, you can still use it with Highlight by following these steps:
- Download and install Highlight from highlightai.com/download
- Navigate to the plugins tab and select "Add Custom Plugin"
-
Configure the plugin with the settings below
Plugin Name
LegbaCommand (node, npx, python, etc.)Please refer to the README for specific instructions on how to obtain API keys or other required environment variables.
- Enable "Start Automatically" if you want the plugin to start when Highlight launches
From the repository
Legba can be installed via Homebrew, Docker, or from source with Cargo. Detailed building instructions, usage options, and configuration for MCP server mode are provided in the project Wiki. The tool is invoked as a command-line executable, with specific flags for target, protocol, wordlist, and concurrency.
Claude Desktop / Cursor
Paste into your MCP client config file to install this server.
{
"mcpServers": {
"legba": {
"Legba": {
"command": "npx",
"args": [
"-y",
"supergateway",
"--sse",
"http://127.0.01:3001/sse"
]
}
}
}
}McpServers
{
"Legba": {
"command": "npx",
"args": [
"-y",
"supergateway",
"--sse",
"http://127.0.01:3001/sse"
]
}
}<p align="center">
<small>Join the project community on our server!</small>
<br/><br/>
<a href="https://discord.gg/btZpkp45gQ" target="_blank" title="Join our community!">
</a>
</p>
<hr/>
<p align="center">
<a href="https://github.com/evilsocket/legba/releases/latest">
</a>
<a href="https://crates.io/crates/legba">
</a>
<a href="https://formulae.brew.sh/formula/legba">
<a href="https://hub.docker.com/r/evilsocket/legba">
<a href="https://github.com/evilsocket/legba/blob/master/LICENSE.md">
</a>
</p>
Legba is a multiprotocol credentials bruteforcer / password sprayer and enumerator built with Rust and the Tokio asynchronous runtime in order to achieve
better performances and stability while consuming less resources than similar tools (see the benchmark below).
For the building instructions, usage and the complete list of options check the project Wiki. For a list of recipes you can check the legba cookbook repository.
Supported Protocols/Features:
AMQP (ActiveMQ, RabbitMQ, Qpid, JORAM and Solace), Cassandra/ScyllaDB, DNS subdomain enumeration, FTP, HTTP (basic authentication, NTLMv1, NTLMv2, multipart form, custom requests with CSRF support, files/folders enumeration, virtual host enumeration), IMAP, IRC, Kerberos pre-authentication and user enumeration, LDAP, MongoDB, MQTT, Microsoft SQL, MySQL, Oracle, PostgreSQL, POP3, RDP, Redis, Samba, SSH / SFTP, SMTP, Socks5, STOMP (ActiveMQ, RabbitMQ, HornetQ and OpenMQ), TCP and UDP port scanning with banner grabbing, Telnet, VNC.
AI Integration
As of version 0.11.0, Legba supports being used by an AI as an MCP server, refer to the documentation on how to configure it.
Benchmark
Here's a benchmark of legba versus thc-hydra running some common plugins, both targeting the same test servers on localhost. The benchmark has been executed on a macOS laptop with an M1 Max CPU, using a wordlist of 1000 passwords with the correct one being on the last line. Legba was compiled in release mode, Hydra compiled and installed via brew formula.
Far from being an exhaustive benchmark (some legba features are simply not supported by hydra, such as CSRF token grabbing), this table still gives a clear idea of how using an asynchronous runtime can drastically improve performances.
| Test Name | Hydra Tasks | Hydra Time | Legba Tasks | Legba Time |
| --------- | ----------- | ---------- | ----------- | ---------- |
| HTTP basic auth | 16 | 7.100s | 10 | 1.560s (🚀 4.5x faster) |
| HTTP POST login (wordpress) | 16 | 14.854s | 10 | 5.045s (🚀 2.9x faster) |
| SSH | 16 | 7m29.85s | 10 | 8.150s (🚀 55.1x faster) |
| MySQL | 4 | 9.819s | 4 | 2.542s (🚀 3.8x faster) |
| Microsoft SQL | 16 | 7.609s | 10 | 4.789s (🚀 1.5x faster) |
<sup> While this result would suggest a default delay between connection attempts used by Hydra. I've tried to study the source code to find such delay but to my knowledge there's none. For some reason it's simply very slow.</sup><br/>
<sup>** For MySQL hydra automatically reduces the amount of tasks to 4, therefore legba's concurrency level has been adjusted to 4 as well.</sup>
License
Legba is released under the GPL 3 license. To see the licenses of the project dependencies, install cargo license with cargo install cargo-license and then run cargo license.
Sign in to leave a review
Use Google, GitHub, or an email account so ratings stay tied to real people.
No reviews posted yet.
