# knavesec/CredMaster

Refactored & improved CredKing password spraying tool, uses FireProx APIs to rotate IP addresses, stay anonymous, and beat throttling

Repository: https://github.com/knavesec/CredMaster
Canonical: https://ross.abutalabs.com/products/credmaster
Language: Python
License: MIT
License Family: permissive
Topics: password-spray, leet-haxor-toolz, brute-force, hacktoberfest
Last push: 2025-03-19T20:36:21+00:00

## Health v2 (maintenance only)
Score: 38/100 (v2, computed 2026-09-03T02:20:16.233290+00:00)
- activity 12, release rhythm 35, longevity 100
- inputs: {"age_days": 2168, "days_push": 532, "days_rel": null, "gap_med": null, "n_releases_24m": 0}
- flags: no_releases
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 1290, forks 173 (observed 2026-08-28T04:04:15.490658+00:00)

## What it is
CredMaster is a Python CLI tool for password spraying and brute-force attacks that rotates the source IP address on every authentication attempt using dynamically generated FireProx AWS passthrough proxies. It includes plugins for services like OWA, EWS, ADFS, MSOL, and Azure endpoints, plus lockout evasion and notification features.

## Use cases
- spray passwords against O365 or Azure AD without getting IP-blocked
- brute force OWA or EWS logins during a pentest
- evade account lockout policies with timed spraying
- rotate IPs per authentication attempt via AWS proxies
- enumerate valid Office365 users without authenticating
- get notified on Slack or Discord when valid credentials are found

## When to choose
- you need evasive password spraying with per-request IP rotation
- you're doing authorized red-team or pentest work against Microsoft auth endpoints
- you want lockout policy evasion and timed spray scheduling built in

## When to avoid
- you have no AWS account or don't want to incur Lambda/API Gateway costs
- you need a general-purpose web brute forcer rather than auth-spray plugins
- your use is unauthorized - this is for authorized security testing only

## Facets
- artifact type: cli-tool
- maturity: active
- function: security, http-client, cli
- domain: penetration-testing, security
- platform: python, cli, cloud
- tags: password-spraying, brute-force, fireprox, aws-proxy, red-team, credential-stuffing, evasion

## Member repositories
- knavesec/CredMaster (main) score 38

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:04:15.490658+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T04:55:38.946927+00:00, confidence not recorded.
  - readme: https://github.com/knavesec/CredMaster (fetched 2026-08-28T04:04:15.490658+00:00, sha 43f88942dfeb)
- Data as of 2026-08-30T08:39:29.467469+00:00.