Python HTTP Basic Authentication Brute Force Tool
BrutePy is a modern, feature-rich tool for performing HTTP Basic Authentication brute force attacks for penetration testing and security assessment purposes.
- Python 3 Compatible: Fully updated for Python 3.x
- Multi-threaded: Support for concurrent requests to speed up brute force attacks
- Modern HTTP Library: Uses the
requestslibrary for better reliability and features - SSL/TLS Support: Proper SSL certificate validation with option to ignore self-signed certificates
- Progress Reporting: Real-time progress updates and statistics
- Output Logging: Save results to file for documentation
- Robust Error Handling: Comprehensive error handling for network issues, timeouts, and invalid inputs
- Security Enhancements: Password redaction in logs and secure defaults
- Input Validation: Validates URLs, file existence, and parameter ranges
- Flexible Configuration: Multiple command-line options for customization
- Python 3.6+
requestslibrary (usually pre-installed)
git clone https://github.com/wjdavis5/BrutePy.git
cd BrutePypython Brute.py https://target.com/admin wordlist.txt adminpython Brute.py https://target.com/admin wordlist.txt admin \
--delay 1000 \
--threads 5 \
--verbose \
--output results.txt \
--ignore-invalid-certificateusage: Brute.py [-h] [--delay DELAY] [--startat STARTAT]
[--ignore-consecutive-empty IGNORE_CONSECUTIVE_EMPTY]
[--threads THREADS] [--verbose] [--output OUTPUT]
[--ignore-invalid-certificate] [--max-retries MAX_RETRIES]
target words user
HTTP Auth Brute Force Tool
positional arguments:
target The target URI. ex http://192.168.1.1
words The wordlist to choose passwords from
user The username to use
optional arguments:
-h, --help show this help message and exit
--delay DELAY Time in milliseconds between each request (default: 5)
--startat STARTAT Start at this line in the wordlist file (default: 0)
--ignore-consecutive-empty IGNORE_CONSECUTIVE_EMPTY
Ignore this many consecutive empty lines before exiting (default: 4)
--threads THREADS Number of concurrent threads (default: 1, max: 50)
--verbose, -v Enable verbose output showing each attempt
--output OUTPUT, -o OUTPUT
Output results to file
--ignore-invalid-certificate
Ignore untrusted SSL certificates
--max-retries MAX_RETRIES
Maximum retries for 429 rate limit responses (default: 3)
python Brute.py https://example.com/admin rockyou.txt admin --delay 2000python Brute.py https://example.com/admin rockyou.txt admin --threads 10 --delay 100python Brute.py https://example.com/admin rockyou.txt admin --startat 1000python Brute.py https://192.168.1.1:8443/admin wordlist.txt admin \
--ignore-invalid-certificate \
--verbose \
--output scan_results.txtpython Brute.py https://example.com/admin rockyou.txt admin \
--threads 5 \
--max-retries 5 \
--delay 500 \
--verboseBrutePy now includes intelligent handling of HTTP 429 (Too Many Requests) responses:
- Exponential Backoff: If no
Retry-Afterheader is present, uses 1s, 2s, 4s, 8s delays - Retry-After Header: Respects server-specified retry delays when provided
- Configurable Retries: Use
--max-retriesto set retry limit (0-10, default: 3) - Thread-Safe: Each thread handles its own retries without blocking others
Trying: admin:[REDACTED] (line 150) -> 429
Rate limited (429). Server requests waiting 5.0s (Retry-After header)
Retrying in 5.0 seconds... (attempt 1/3)
Trying: admin:[REDACTED] (line 150) (attempt 2/4) -> 200
[SUCCESS] Authentication successful!
# Conservative approach for heavily rate-limited targets
python Brute.py https://example.com/admin wordlist.txt admin \
--threads 1 \
--delay 2000 \
--max-retries 5 \
--verbose
# Balanced approach for moderate rate limiting
python Brute.py https://example.com/admin wordlist.txt admin \
--threads 3 \
--delay 1000 \
--max-retries 3- Responsible Use: Only use this tool against systems you own or have explicit permission to test
- Rate Limiting: Use appropriate delays to avoid overwhelming target servers
- SSL Verification: SSL certificate validation is enabled by default for security
- Password Logging: Passwords are redacted in console output to prevent accidental exposure
- Python 3 Compatibility: Fixed all Python 2 syntax issues
- Modern Libraries: Migrated from
httplib2torequests - Multi-threading: Added concurrent request support for better performance
- Enhanced Security: SSL verification enabled by default, password redaction
- Better Error Handling: Comprehensive exception handling and input validation
- Progress Reporting: Real-time status updates and completion statistics
- Output Options: Save results to file with
--outputflag - Verbose Mode: Detailed logging with
--verboseflag - Input Validation: Validates URLs, files, and parameter ranges
- Graceful Interruption: Proper handling of Ctrl+C and cleanup
- Rate Limit Handling: Intelligent 429 response handling with exponential backoff and Retry-After header support
Common wordlists for brute force attacks:
This tool is intended for authorized security testing and educational purposes only. Users are responsible for ensuring they have proper authorization before testing any systems. Unauthorized access to computer systems is illegal and may result in criminal charges.
This project is licensed under the GNU General Public License v2.0 - see the LICENSE file for details.
- Fork the repository
- Create a feature branch
- Make your changes
- Add tests if applicable
- Submit a pull request
- v2.0: Complete modernization with Python 3, threading, enhanced security
- v1.0: Original Python 2 implementation