Open Source Brute Force Tools

DirBuster is a multi threaded java application designed to brute force directories and files names on web/application servers.

A pronounceable password generator plugin for KeePass. NOTE: This project has been discontinued. It hasn't been worth it to maintain the project for a while now, so no more updates will be made to the plugin. The algorithm this plugin uses is based off FIPS-181 which was withdrawn by NIST a while back. The proliferation of password managers that seamlessly run on multiple platforms (some of which are free) has also removed almost all advantages of using randomly generated pronounceable passwords. If you have a use case for this plugin, reconsider it. If you still think using randomly generated pronounceable passwords are worth it for your use case, reconsider it some more.

About GameOver: Project GameOver was started with the objective of training and educating newbies about the basics of web security and educate them about the common web attacks and help them understand how they work. GameOver has been broken down into two sections. Section 1 consists of special web applications that are designed especially to teach the basics of Web Security. This seciton will cover XSS CSRF RFI & LFI BruteForce Authentication Directory/Path traversal Command execution SQL injection Section 2 is a collection of dileberately insecure Web applications. This section provides a legal platform to test your skills and to try and exploit the vulnerabilities and sharpen your skills before you pentest live sites. We would advice newbies to try and exploit these web applications. These applications provide real life environments and will boost their confidence.

Generic clustering/load-balancing platform (over a LAN or internet) using java based P2P Aorta workers that execute java "tasklets". Various tasklets can be implemented to solve fractals, process images, render webpages, crack RSA "brute force".

dkbf is a distributed, keyboard, brute-force program for Linux clusters that attacks Windows NT Lanman and NT hashes using the Message Passing Interface (MPI).

An original bruteforce-based encryption/decryption system. BBE was originally conceived to chat with encrypted text on IRC. mIRC and X-Chat support BBE via script addon. BBE can also encrypt MIME encoded files. Blowfish encryption is currently supported.

We developed a classic solution that reflects the very nature of quantum mechanics in whole, ultimately demonstrating the raw power of numbers. We developed a truly irreversible one way algorithm which, when applied to information, both encrypts and decrypts it. That is to say that the algorithm which encrypts the information works in the same direction as the algorithm that decrypts it. This in itself is the very nature of quantum mechanics - "forward only". Through a quantum-entanglement-like operation, we created very robust encryption methodology which will secure information for some time to come through sheer numbers and flexibility. With 2^65536 possible keys a brute force attack on a key is simply infeasible. The full version, due to release March 11, 2013 will allow password protection which helps protect your information by forcing the impostor to not only produce the 65536 bit key, but have your password as well and allows for individual passwords for individual files.

CryptoHelper is a Java program designed to aid in the decryption of classical ciphers, ie pre WWII ciphers. It brings together tools like frequency analysis, friedman tests, enciphering/deciphering for several clasical ciphers, and brute force algorithm

A daemon that creates realtime dynamic, expirable iptables rules to block/drop IP addresses attempting brute-force breakin attacks on a linux host via ssh or other mechanism. Highly customizable and extensible.

Login Alert is a small one click wizard GUI that sets up scripts on your Ubuntu/Debian Linux box. SSH Brute Force prevention through iptables, SSH and local login email alert notifications, able to install fail2ban and denyhost with a tick of the mouse.

Elemata is a free content management for personal use and commercial use at the moments. Elemata will provide you with the best CMS experience. Learn how to turn any html/css document into a theme at elematacms.com

FZBFD is Brute Force Detection for Filezilla ftp server. fzbfd.pl looks at the logs from filezilla and will auto ban or block ips from accessing your FTP server. FZBFD can be setup to run hourly using task manager and uses dshield.org's top offenders...

Iman Random Password Generator, a very useful tool for Admins to generate secured password against BruteForce attack. Selectable up&lower case letters, numbers and symbols up to 1024 characters with copy to clipboard button and Auto Save configuratio

Its a light weight Intrusion detection and defense system works with windows firewall to protect any windows operating system from attacks that are intended to hack the server or provide any operational damage. By keeping eye on network activities and event viewer logs, ServerCloak capture and log any failed/denied inbound calls from IPv4 as well as IPv6. Once the calls reaches its limit, the service immediately tells windows firewall to block the attacking IP by adding a denial inbound firewall rule. This software is specially developed to protect windows server from hackers.

JBrute is an open source tool written in Java to audit security and stronghold of stored password for several open source and commercial apps. It is focused to provide multi-platform support and flexible parameters to cover most of the possible password-auditing scenarios. Java Runtime version 1.7 or higher is required for running JBrute. Supported algorithms: MD5 MD4 SHA-256 SHA-512 MD5CRYPT SHA1 ORACLE-10G ORACLE-11G NTLM LM MSSQL-2000 MSSQL-2005 MSSQL-2012 MYSQL-322 MYSQL-411 POSTGRESQL SYBASE-ASE1502 INFORMIX-1170 To see syntax examples: https://sourceforge.net/p/jbrute/wiki/Examples To see last news: https://sourceforge.net/p/jbrute/blog FAQ: https://sourceforge.net/p/jbrute/wiki/FAQ/ General questions: jbrute-users@lists.sourceforge.net (you can suscribe to mailing list at https://lists.sourceforge.net/lists/listinfo/jbrute-users) Author: Gonzalo L. Camino Icon Art: Ivan Zubillaga Made in: Argentina :)

The John Darm project aims at developping a software that can tests a brute force attack on weak UNIX passwords. It s a multi-client application that dispatches the calculations between the different clients.

JoinFinder is a useful tool that helps you to find join between two tables by foreign keys defined into tables or by a brute-force method. It is a Java8 project and it uses jna library for autocompletition feature. At the moment JoinFinder is in Italian and supports only MS SQL server, but I hope to add soon other DB support and English translation.

NBTView is a 'NetBIOS Swiss Army Knife' written in C, and usable under several UNIX-like systems. NBTView allows you to passively monitor NetBIOS intelligence (users logged in, shares, etc.), run queries against machines, and brute-force share passwords.

One-Threaded MD5 Hash Bruteforce written in Delphi.

Simple UI to test the effectiveness of a heuristic algorithm against the brute force method for path finding among an arbitrary number of arbitrarily placed points on a grid. This is an educational project, don't expect new and better methods.

using PHP (and some ShellScript) to protect your linux server against bruke force attacks(http://en.wikipedia.org/wiki/Brute_force_attack). also keep a log in MySQL and have email reporting

Detect your web servers being scanned by brute force tools and vulnerability scanners.Helps you quickly identify probable probing by bad guys who's wanna dig possible security holes.

A java application for creating, playing and solving SuDoku puzzles of various types. Features both a Swing GUI and command-line operation. The automatic solving of puzzles uses "smart" techniques rather than a brute force search of every possibility.

Computer chess engine written using Qt4, which works under Knights, Jose, Arena and other chess board GUI games. Uses bitboard game representation and alpha beta brute-force search to analyse chess positions.

RWSecure parses the /var/log/secure (or specified secure log) file for Invalid usernames or Failed password. If more than x invalid or failed attempts by one IP(i.e. brute force), it will add that IP to your /etc/hosts.deny file by default (also configur