Scanners
patator: brute-force SSH, FTP, and HTTP logins
patator is an open-source, multi-threaded, multi-protocol brute-forcing tool that tests credentials and fuzzes services such as SSH, FTP, HTTP, SMTP, and databases through modular engines with fine-grained response filtering.
installpip install patator
Python · GPL-2.0 license
overview
What patator does
After host and service discovery, run patator as the credential-testing stage. Choose a module (ssh_login, ftp_login, http_fuzz, mysql_login), feed hosts, users, and passwords, and collect FILE and FOLDER results.
Control the run with --threads, --rate-limit, and --timeout. ignore-regex drops failed-login noise. --start and --stop offset the payload product so long jobs can resume. --groups switches cartesian product to lockstep.
Prefer hydra or medusa for simple parallel sprays across many protocols. Prefer patator when you need modular response filtering and payload offsets. A Hits/Done/Skip/Fail/Size line of all zeros usually means empty wordlists or a bad FILEn path.
source github.com/lanjelot/patator
use cases
Where patator fits
Brute force credentials over many protocols
Select the module for the service, then feed username and password files to test logins across SSH, FTP, HTTP, MySQL, and more with one engine.
Filter out failed-login noise
Set a condition on the response so patator drops attempts that match a failure pattern and reports only the ones that look like a valid login.
Control combinations and pacing
Iterate payload sets as a cartesian product or in lockstep, set --threads, and add a --rate-limit to stay within a target's tolerance.
Resume a large run
Set --start to an offset in the combined payload space to pick up a long brute-force run where it stopped instead of restarting from zero.
reference
patator inputs and flags
| Name | Type | Flag | Description |
|---|---|---|---|
| module | STRING | · | Module name selecting the protocol or service to test (ssh_login, ftp_login, http_fuzz, mysql_login). |
| hosts | FILE | · | List of host:port targets. |
| users | FILE | · | Usernames to test. |
| passwords | FILE | · | Passwords to test. |
| threads | STRING | --threads | Number of threads (default 10). |
| rate-limit | STRING | --rate-limit | Wait N seconds between each attempt (default 0). |
| ignore-regex | STRING | · | Do not report responses that match this regex. |
| start | STRING | --start | Start from offset N in the product of all payload sets. |
Showing key inputs. patator exposes 16 inputs in total.
Full flag reference (16 inputs)
| Name | Type | Flag | Description |
|---|---|---|---|
| yes | BOOLEAN | -y | automatically answer yes for all questions |
| stop | STRING | --stop | stop at offset N |
| debug | BOOLEAN | --debug | enable debug messages |
| hosts | FILE | · | list of host:port targets |
| start | STRING | --start | start from offset N in the product of all payload sets |
| users | FILE | · | usernames to test |
| groups | STRING | --groups | iterate over payload sets simultaneously (pitchfork) instead of the cartesian product; default is '0,1..n' |
| module | STRING | · | module name |
| threads | STRING | --threads | number of threads (default is 10) |
| timeout | STRING | --timeout | wait N seconds for a response before retrying payload (default is 0) |
| passwords | FILE | · | passwords to test |
| rate-limit | STRING | --rate-limit | wait N seconds between each attempt (default is 0) |
| max-retries | STRING | --max-retries | skip payload after N retries (default is 4) (-1 for unlimited) |
| ignore-regex | STRING | · | do not report responses that match this regex |
| auto-progress | STRING | --auto-progress | automatically display progress every N seconds |
| condition-delimiter | STRING | -X | delimiter string in conditions (default is ',') |
example
Run patator
# SSH login brute force, drop failed attempts, paced at 1s
patator ssh_login host=198.51.100.10 user=FILE0 password=FILE1 0=users.txt 1=passwords.txt --threads 5 --rate-limit 1 -x ignore:mesg='Authentication failed'17:42:03 patator INFO - Starting Patator v1.0 (https://github.com/lanjelot/patator)
17:42:03 patator INFO - code size time | candidate | num | mesg
17:42:03 patator INFO - -----------------------------------------------------------------
17:42:05 patator INFO - 1 22 0.031 | root:root | 3 | Authentication failed.
17:42:06 patator INFO - 1 22 0.028 | admin:admin | 11 | Authentication failed.
17:42:08 patator INFO - 0 40 0.412 | deploy:s3cret2026 | 27 | SSH-2.0-OpenSSH_8.9
17:42:11 patator INFO - Hits/Done/Skip/Fail/Size: 1/40/0/0/40
17:42:11 patator INFO - Time: 0h 0m 8s.guidance
Choosing patator
Use patator for multi-protocol credential testing with precise response filtering after host and port discovery. For a single HTTP panel form, a dedicated tool or hydra http-post-form may be simpler. For broad AD or SMB spraying, prefer netexec.
hydra
Parallel login cracker across many protocols. patator adds modular response filtering and payload offsets.
medusa
Another parallel brute forcer. patator makes hit-versus-noise separation easier via ignore-regex and conditions.
netexec
Multi-protocol enumeration and spraying. patator is the focused per-module brute-force engine.
faq
patator questions
related
More Scanners tools
ac-scanner
BHUSA Arsenal TLS/SSH crypto inventory with post-quantum readiness signals and CBOM-shaped output.
airixss
Reflection triage for parameter URLs during recon.
bedrock-keys-security
Black Hat Arsenal hunting for phantom IAM users behind Bedrock keys, with offline key decode and org scan.
cmseek
CMS detection and version fingerprinting.
jaeles
Signature-driven web application scanner.
joomscan
OWASP Joomla vulnerability scanner for CMS flaws and misconfigurations.
Run patator yourself
A host list and username and password files feed patator, which brute forces the service and writes the valid credentials as a queryable output.
Facts on this page come from the live Trickest tool library.