hb-brute

Web Login Audit (WLA)

A credential-spray audit tool for testing web login forms without getting banned. This tool is designed to work with real web applications while avoiding detection and bans.

Features

• User-Agent Rotation: Rotates through a list of common user agents to mimic real browsers.
• Rate Limiting: Implements randomized delays between requests to avoid detection.
• Proxy Support: Supports rotating proxies to distribute requests across multiple IPs.
• Realistic Headers: Uses realistic HTTP headers to mimic real browser requests.
• Signal Detection: Detects success, failure, lockout, CAPTCHA, and rate-limiting signals.
• Structured Logging: Provides detailed logging for debugging and monitoring.

Installation

npm install -g wla

Usage

wla --credentials creds.txt --url http://example.com/login

Options

• --username <username>: Username/email to test against (default: audit@localhost).
• --credentials <file>: Path to credential list file (one password per line).
• --proxies <file>: Path to proxy list file (optional).
• --workers <number>: Concurrent workers (default: 5).
• --batch <number>: Batch size for large lists (default: 200).
• --rate-min <number>: Minimum per-request sleep seconds (default: 1.0).
• --rate-max <number>: Maximum per-request sleep seconds (default: 3.0).
• --max-credentials <number>: Hard cap on number of credentials to try (default: 100000).
• --timeout <number>: Per-request timeout seconds (default: 15).
• --retries <number>: Network-error retries per credential (default: 2).
• --no-stop-on-success: Continue scanning after the first success.
• --report-dir <dir>: Directory to write reports (default: reports).
• --url <url>: Override endpoint URL.
• --username-field <field>: Override username form field.
• --password-field <field>: Override password form field.
• --success-marker <marker>: Substring in response body indicating success.
• --success-status <status>: HTTP status considered success if no marker given.
• --allow-redirects: Follow redirects on POST.
• --extra-fields <fields>: Extra form fields 'a=1,b=2'.
• --verbose: Increase logging verbosity.

Example

wla --credentials creds.txt --url http://example.com/login --username admin@example.com --workers 5 --batch 100 --rate-min 1.0 --rate-max 3.0 --verbose

Responsible Use

This tool is for testing login endpoints you own or are explicitly authorized to audit. Do not point it at services you do not own or have written permission to test.

License

MIT