auth_bruteforce
Test login security by enumerating valid usernames and brute-forcing passwords against web authentication forms to identify weak credentials.
Instructions
Username enumeration and credential brute-force.
First enumerates valid usernames (if failure messages differ), then brute-forces passwords against confirmed usernames.
Returns: {"username_enumeration": [{"username": str, "exists": bool}], "valid_credentials": [{"username": str, "password": str}], "requests_sent": int}.
Side effects: Sends login requests. May trigger account lockout.
Errors: Rate limiting may block requests. Use realistic credentials to avoid WAF detection.
Tool call template
Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.
{
"id": 1,
"jsonrpc": "2.0",
"method": "tools/call",
"params": {
"arguments": {
"url": "<url>",
"usernames": "<usernames>",
"passwords": "<passwords>"
},
"name": "auth_bruteforce"
}
}Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| url | Yes | Login form URL | |
| usernames | Yes | Usernames to test | |
| passwords | Yes | Passwords to test | |
| username_field | No | Form field name for username | |
| password_field | No | Form field name for password | |
| method | No | HTTP method | |
| success_indicator | No | String in response that indicates success (e.g. 'dashboard', 'welcome') | |
| failure_indicator | No | String in response that indicates failure (e.g. 'invalid', 'incorrect') | |
| content_type | No | Request content type | |
| concurrent | No | Concurrent requests |