BruteForceAI

Why we included this project

Penetration testers and bug bounty hunters usually map out login forms by hand before they can even try credentials. BruteForceAI skips that step: it sends the page HTML to an LLM, run locally through Ollama or via Groq in the cloud, and gets back the selectors it needs to drive the form, so attacks don't depend on hand-written selectors. The attack stage covers both brute-force and password-spray modes, with jittered delays that mimic human timing, rotating user agents, proxy support, and webhook alerts when a login succeeds. It can work many targets at once and retries with feedback when the model misreads a form, which saves real time on large scope reviews. Teams auditing their own login flows will find the SQLite attempt log and duplicate-skip behavior useful for tracking what was tested.