$ show evilsocket/legba
Legba is a production-grade multi-protocol credential bruteforcer, password sprayer, and enumerator written in Rust. It operates as a CLI tool with a plugin-based architecture supporting 30+ protocols (HTTP, SSH, SMB, LDAP, Kerberos, SQL variants, NoSQL, message queues, SNMP, etc.). The core system uses an async runtime (Tokio) and a global plugin inventory managed via a `register_plugin!` macro and the `Plugin` trait. Credential sources are generated by a flexible expression parser that supports wordlists, globs, permutations, ranges, and combinations. Sessions can be saved and restored in JSON format, and output supports text, CSV, and JSONL. In addition to CLI, Legba exposes a REST API and an MCP (Model Context Protocol) server, enabling AI agents to drive credential testing programmatically. A YAML recipe system allows reusable attack configurations with variable substitution.
The LLM identified 3 files worth highlighting for reuse:
Parses credential expressions (wordlists, globs, permutations, ranges, combinations) into iterators. Self-contained and reusable for any brute-force or enumeration tool requiring flexible input generation. Demonstrates non-obvious skill in parsing and composing lazy iterators.
Provides the iterator implementations for constant, wordlist, glob, permutation, range, and multi-expressions. These are used by the expression parser and could be extracted as a standalone crate for generating credential or payload combinations. The permutation iterator is adapted from a known zip-password-finder but generalized.
Implements a `StreamLike` trait wrapping async TCP/TLS streams, with connect, read, write, and upgrade methods. Reused by many protocol plugins (FTP, IMAP, POP3, SMTP, IRC, Telnet, etc.). Isolated and could be extracted as a small async networking helper library.