Developing an auxiliary—the SSH brute force module

For checking weak login credentials, we need to perform an authentication brute force attack. The agenda of such tests is not only to test an application against weak credentials but to ensure proper authorization and access controls as well. These tests ensure that attackers cannot simply bypass the security paradigm by trying a non-exhaustive brute force attack, and are locked out after a certain number of random guesses.

Designing the next module for authentication testing on the SSH service, we will look at how easy it is to design authentication-based checks in Metasploit, and perform tests that attack authentication. Let's now jump into the coding part and begin designing a module, as follows:

require 'metasploit/framework/credential_collection' 
require 'metasploit/framework/login_scanner/ssh'
class MetasploitModule < Msf::Auxiliary 
include Msf::Auxiliary::Scanner
include Msf::Auxiliary...