Ross ROSS = Recommend OSS · open-source software intelligence for agents

MorDavid/BruteForceAI

Advanced LLM-powered brute-force tool combining AI intelligence with automated login attacks observed · 2026-08-28

github.com/MorDavid/BruteForceAI · homepage · Python · NOASSERTION (other) observed · 2026-08-28

Health v2 · maintenance only

60/100

  • Activity 93
  • Release rhythm 35
  • Longevity 29

Flags: no_releases no_license

How is this computed?

round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10) — computed 2026-09-03. Adoption (stars, forks) is never an input.

  • gap_med: n/a
  • age_days: 410
  • days_rel: n/a
  • days_push: 47
  • n_releases_24m: 0

Full methodology

Adoption not part of the score

1677 stars · 330 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

BruteForceAI is a Python-based penetration testing tool that uses LLMs (via Ollama or Groq) to automatically analyze login page HTML and identify form selectors, then executes multi-threaded brute-force or password-spray attacks with human-like timing and evasion techniques. It includes SQLite logging, webhook notifications, proxy support, and user-agent rotation.

Use cases

  • brute force login pages with AI-discovered form selectors
  • run password spray attacks against a list of usernames
  • automatically identify login form fields on a target page
  • test credential strength during authorized penetration tests
  • get notified on Discord or Slack when valid credentials are found
  • evade rate limiting with human-like delays and user-agent rotation
  • log brute-force attempts to a SQLite database during engagements

When to choose

  • you need to brute-force login forms without manually inspecting HTML for selectors
  • you want AI-assisted form analysis during an authorized pentest or bug bounty engagement
  • you need password spray and bruteforce modes with evasion features like jitter and proxy support
  • you want webhook alerts and persistent logging of credential attempts

When to avoid

  • you lack authorization to test the target system - unauthorized use is illegal
  • you need a general-purpose web vulnerability scanner rather than a login attack tool
  • you cannot run or access an LLM backend like Ollama or Groq
  • you need a commercial, licensed product - the license is non-commercial

Facets

cli-tool · maturity active

penetration-testing security llm-inference web-scraping cli penetration-testing security artificial-intelligence large-language-models python windows cli brute-force password-spray bug-bounty login-forms ollama groq red-team credential-stuffing evasion webhook-notifications linux macos

3 sources

Member repositories

RepositoryRoleHealth v2
MorDavid/BruteForceAImain60

For agents

markdown · JSON · MCP: product_card(name="MorDavid/BruteForceAI")

Data as of 2026-08-30T08:39:29.467469+00:00 · Report a problem