New BruteForceAI Tool Automates Login Page Detection and Attacks

BruteForceAI is a new penetration testing tool that incorporates automation and artificial intelligence to enhance login page detection and brute-force attack capabilities.

BruteForceAI is designed for use by security professionals and researchers. The tool automates two key stages of login attacks: identifying login forms and executing credential attempts. It utilizes Large Language Model (LLM) analysis and advanced attack features, distinguishing it from traditional brute-force tools.

In the initial stage, BruteForceAI employs an LLM to scan web pages, automatically identifying login form elements and selectors. This AI-driven analysis minimizes the manual labor typically required to inspect HTML code for username and password fields. Users provide a list of target URLs, and the tool identifies the correct form elements swiftly, enhancing accuracy and speeding up the reconnaissance process.

Upon detecting forms, BruteForceAI offers two primary attack strategies: a classic brute-force approach that tests all username and password combinations, and a password spray mode that applies each password across all usernames. Both modes operate in a multi-threaded environment, enabling multiple simultaneous attempts while incorporating human-like delays and random jitter. These timing variations help avoid detection by web application firewalls and intrusion prevention systems.

LLM-Powered Form Analysis: Automatically discovers form fields and selectors using models like Ollama and Groq. Multi-Threaded Attacks: Supports up to 100+ threads for rapid credential testing without manual coordination. Attack Modes: Offers full brute-force or password-spray modes to optimize testing strategies. Evasion Techniques: Randomizes User-Agent strings, utilizes proxy rotation, and simulates human-like timing patterns. Webhook Notifications: Provides real-time alerts via Discord, Slack, Microsoft Teams, or Telegram upon successful logins. Comprehensive Logging: Maintains detailed SQLite database records of every attempt, including timestamps, errors, and successes. Configurable Delays & Jitter: Allows fine-tuning of pause durations and randomness to blend in with legitimate traffic. Automatic Update Checker: Includes a built-in version check against a central repository for the latest updates. Browser Visibility Control: Offers options to run attacks headless or with a visible browser for debugging and demonstration purposes. Feedback-Based Retries: Implements intelligent retry logic that adapts from previous failures to enhance success rates.

Install prerequisites:

Python 3.8+ Playwright browsers:

pip install playwright playwright install chromium

git clone https://github.com/MorDavid/BruteForceAI.git cd BruteForceAI pip install -r requirements.txt

After installation, configure an LLM provider—either locally via Ollama or through the cloud via Groq—to analyze and attack login forms efficiently.

BruteForceAI is intended solely for authorized penetration testing and educational purposes, as stated in its legal disclaimer. The tool is available under a non-commercial license on GitHub, ensuring its use by security professionals without enabling illicit activities.

With its advanced features and flexible attack options, BruteForceAI represents the next generation of brute-force tools, helping security teams streamline testing workflows, reduce manual effort, and conduct stealthy operations against modern login pages.

Based on reporting by GBHackers.