Python Brute Force Attack Tools
A universal brute force tool with CSRF bypass support for both traditional form-based and JSON API logins.
Features
- Form-based login (traditional HTML forms)
- JSON API login (modern SPA/React/Vue/Angular sites)
- Universal CSRF bypass (hidden inputs, meta tags, cookies, headers)
- Auto-detection of login type, field names, and API endpoints
- Multi-threaded with progress bar
- Color-coded terminal output
Installation
Usage
The tool walks you through 3 steps:
Step 1 — Target Info
You'll be asked for:
- Login page URL — e.g. https://example.com/login
- Username / email — the account to test
- Wrong password error message — log in with a wrong password in your browser, copy the exact error text (check DevTools → Network → response body if needed)
Step 2 — Review & Adjust
The tool auto-detects field names, login mode, and API endpoint by fetching the page. Review what it found and press Enter to accept, or type a new value to override.
Login mode options: auto (use detected), form (HTML form POST), api (JSON POST).
Step 3 — Attack Settings
- Workers — number of concurrent threads (default 10)
- Password file — path to your wordlist (default passwords.txt)
A summary is shown before starting. Confirm with Y to begin.
Example
Finding the Error Message
If you're not sure what to enter for the error message:
1. Open the login page in your browser
2. Open DevTools (F12) → Network tab
3. Submit a wrong password
4. Click the login request → Response tab
5. Copy the exact error text from the response
CSRF Bypass
The tool automatically handles these CSRF protection methods:
Legal Disclaimer
Only use this tool on systems you own or have explicit permission to test.
Unauthorized access to computer systems is illegal. This tool is for:
- Security researchers
- Penetration testers
- CTF players
- Educational purposes
Resources
- Medium Article
- Password Lists
Contributing
[truncated]
A universal brute force tool with CSRF bypass support for both traditional form-based and JSON API logins.
Features
- Form-based login (traditional HTML forms)
- JSON API login (modern SPA/React/Vue/Angular sites)
- Universal CSRF bypass (hidden inputs, meta tags, cookies, headers)
- Auto-detection of login type, field names, and API endpoints
- Multi-threaded with progress bar
- Color-coded terminal output
Installation
Usage
The tool walks you through 3 steps:
Step 1 — Target Info
You'll be asked for:
- Login page URL — e.g. https://example.com/login
- Username / email — the account to test
- Wrong password error message — log in with a wrong password in your browser, copy the exact error text (check DevTools → Network → response body if needed)
Step 2 — Review & Adjust
The tool auto-detects field names, login mode, and API endpoint by fetching the page. Review what it found and press Enter to accept, or type a new value to override.
Login mode options: auto (use detected), form (HTML form POST), api (JSON POST).
Step 3 — Attack Settings
- Workers — number of concurrent threads (default 10)
- Password file — path to your wordlist (default passwords.txt)
A summary is shown before starting. Confirm with Y to begin.
Example
Finding the Error Message
If you're not sure what to enter for the error message:
1. Open the login page in your browser
2. Open DevTools (F12) → Network tab
3. Submit a wrong password
4. Click the login request → Response tab
5. Copy the exact error text from the response
CSRF Bypass
The tool automatically handles these CSRF protection methods:
Legal Disclaimer
Only use this tool on systems you own or have explicit permission to test.
Unauthorized access to computer systems is illegal. This tool is for:
- Security researchers
- Penetration testers
- CTF players
- Educational purposes
Resources
- Medium Article
- Password Lists
Contributing
[truncated]