MorDavid/BruteForceAI

What it solves

BruteForceAI is a penetration testing tool that automates the process of identifying and attacking login forms. It replaces the manual effort of finding HTML selectors for usernames and passwords with AI-driven analysis, allowing for more efficient and scalable security testing.

How it works

The tool operates in two primary stages:

1. AI Analysis: It uses Large Language Models (LLMs) via Ollama (local) or Groq (cloud) to analyze the HTML content of a target URL and automatically identify the correct login form selectors.
2. Smart Attack: Once selectors are identified, it executes multi-threaded brute-force or password spray attacks. It uses Playwright for browser automation and incorporates evasion techniques like User-Agent rotation and randomized timing (jitter) to mimic human behavior.

Who it’s for

Security researchers, authorized penetration testers, and bug bounty hunters who need to automate the identification of login forms and AI-enhanced attack patterns.

Highlights

• LLM-Powered Identification: Automatically finds login form elements using models like Llama 3.2 or Llama 3.3.
• Flexible Attack Modes: Supports both traditional brute-force (all combinations) and password spraying (one password across many users).
• Evasion Techniques: Includes proxy support, User-Agent rotation, and human-like timing patterns to avoid detection.
• Integrated Notifications: Sends real-time success alerts via Discord, Slack, Teams, and Telegram webhooks.
• Local or Cloud AI: Compatible with local LLMs via Ollama or high-performance cloud models via Groq.