# MorDavid/BruteForceAI

Advanced LLM-powered brute-force tool combining AI intelligence with automated login attacks

Repository: https://github.com/MorDavid/BruteForceAI
Canonical: https://ross.abutalabs.com/products/bruteforceai
Homepage: https://www.MORDAVID.com
Language: Python
License: NOASSERTION
License Family: other
Topics: ai, bruteforce, bugbounty, llm, loginpages
Last push: 2026-07-17T22:45:32+00:00

## Health v2 (maintenance only)
Score: 60/100 (v2, computed 2026-09-03T02:20:16.233290+00:00)
- activity 93, release rhythm 35, longevity 29
- inputs: {"age_days": 410, "days_push": 47, "days_rel": null, "gap_med": null, "n_releases_24m": 0}
- flags: no_releases, no_license
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 1677, forks 330 (observed 2026-08-28T04:05:20.912168+00:00)

## What it is
BruteForceAI is a Python-based penetration testing tool that uses LLMs (via Ollama or Groq) to automatically analyze login page HTML and identify form selectors, then executes multi-threaded brute-force or password-spray attacks with human-like timing and evasion techniques. It includes SQLite logging, webhook notifications, proxy support, and user-agent rotation.

## Use cases
- brute force login pages with AI-discovered form selectors
- run password spray attacks against a list of usernames
- automatically identify login form fields on a target page
- test credential strength during authorized penetration tests
- get notified on Discord or Slack when valid credentials are found
- evade rate limiting with human-like delays and user-agent rotation
- log brute-force attempts to a SQLite database during engagements

## When to choose
- you need to brute-force login forms without manually inspecting HTML for selectors
- you want AI-assisted form analysis during an authorized pentest or bug bounty engagement
- you need password spray and bruteforce modes with evasion features like jitter and proxy support
- you want webhook alerts and persistent logging of credential attempts

## When to avoid
- you lack authorization to test the target system - unauthorized use is illegal
- you need a general-purpose web vulnerability scanner rather than a login attack tool
- you cannot run or access an LLM backend like Ollama or Groq
- you need a commercial, licensed product - the license is non-commercial

## Facets
- artifact type: cli-tool
- maturity: active
- function: penetration-testing, security, llm-inference, web-scraping, cli
- domain: penetration-testing, security, artificial-intelligence, large-language-models
- platform: python, windows, cli
- tags: brute-force, password-spray, bug-bounty, login-forms, ollama, groq, red-team, credential-stuffing, evasion, webhook-notifications, linux, macos

## Member repositories
- MorDavid/BruteForceAI (main) score 60

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:05:20.912168+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T03:41:35.738186+00:00, confidence not recorded.
  - readme: https://github.com/MorDavid/BruteForceAI (fetched 2026-08-28T04:05:20.912168+00:00, sha 394563860259)
  - homepage: https://www.MORDAVID.com (fetched 2026-08-29T11:15:00.200111+00:00, sha 292e908d6045)
  - site_page: https://www.mordavid.com/home (fetched 2026-08-29T11:15:00.203097+00:00, sha 292e908d6045)
- Data as of 2026-08-30T08:39:29.467469+00:00.