MorDavid

BruteForceAI uses an LLM to understand login forms before testing them The interesting part of this tool isn’t password guessing. It’s using AI to identify how a login page works before the testing starts. BruteForceAI separates the workflow into two stages: 1. An LLM analyzes the page’s HTML to identify username, password, and submission elements. 2. Browser automation uses those selectors to perform credential testing within an authorized assessment. What’s included? - Brute-force and password-spray modes. - Multi-threaded execution. - Configurable delays and jitter. - Proxy support and User-Agent rotation. - Local LLM support through Ollama, or cloud inference through Groq. - SQLite logging and duplicate-attempt prevention. - Discord, Slack, Teams, and Telegram notifications. What makes it worth a look? Rather than manually configuring every login form, the tool uses an LLM to discover the relevant selectors. The README also lists retries with feedback and DOM-change detection for assessing whether a login succeeded. That’s AI assisting the automation—not evidence that it can bypass authentication or reliably handle every login workflow. Two things to know before using it - The project explicitly limits use to education and authorized testing, including your own applications and properly scoped security assessments. - It uses a non-commercial license, so don’t assume it’s unrestricted for paid engagements or commercial products. GitHub: MorDavid/BruteForceAI Would you trust an LLM to identify login elements automatically, or still want to review its selectors before testing? Join Discord

🚨 BruteForceAI: A LLM-powered login testing tool that combines AI form analysis with automated credential attacks GitHub: MorDavid/BruteForceAI The tool uses an LLM to analyze login pages and automatically identify the username, password, and submission elements before launching authorized authentication testing. Features include: • LLM-powered login form analysis • Brute-force and password-spray modes • Multi-threaded execution • Proxy and User-Agent rotation • Configurable delays and jitter • Ollama and Groq support • SQLite logging • Discord, Slack, Teams, and Telegram notifications Designed for penetration testing and authorized security assessments where login workflows need to be identified and tested at scale.