JsonSecurity /
simpleBruteforcePHP
This is a simple proof of concept of a brute force attack with Python on HTML and PHP login forms.
Active repository
PHPNo license
⑂ 0 forks◯ 0 issuesUpdated Nov 5, 2025
Loading repository data…
akshatmiglani / repository
Brute-force-for-login-bypass-on-a-local-website
This is a project to perform a BRUTE FORCE attack on a self hosted website to better the understanding of the importance of cybersecurity.
#brute-force-attacks#bruteforce#burpsuite#college-project#cybersecurity#cybersecurity-awareness
Live repository statistics
★ 33Stars
⑂ 11Forks
◯ 0Open issues
◉ 33Watchers
README preview
Brute-force-for-login-bypass-on-a-local-website
Description - Sample Website Backstory
- A-Z Education website offers courses related to React Development, Amazon Web Services and Cyber Security algorithms.
- The website has a login page through which users create an account to purchase and view videos related to the course.
- A-Z Education does not utilize multi factor authentication methods like One Time Passwords, Security Questions, or email verification which leaves it vulnerable to a variety of attacks.
Bruteforce Attack
In this case, I, the attacker, try to access the administrator panel of the website using a list of common usernames and passwords. To carry out the attack, Burp Intruder is used to find firstly the admin username and after finding the username finding the respective admin password to view the dashboard for the website.
Prerequisites
- Python
- Burp Suite
Steps to Carry Out the Attack
- Clone this repositroy and start the flaks app.
git clone https://github.com/akshatmiglani/Brute-force-for-login-bypass-on-a-local-website.git
cd Brute-force-for-login-bypass-on-a-local-website
pip install flask
python app.py
-
Launch Burp Suite and access the login panel in Burp Browser.
-
Make sure the intercept is on in Burp Suite and use any credentials to post a request.
- Send this request to Burp Repeater, Choose the attack type to Sniper and add a payload position to username.
-
Using the common
usernames.txtof this repostiory, add this to the payload as a simple list and start the attack. -
Sample bruteforce attack on username.
-
Observe that one status code is different than the others.
-
After finding out that “admin” is the admin username, we change the payload to the password parameter and apply brute force using password list to find the password.
- Now we come to know the password and username for the admin (because of the status codes) and thus we login in to the admin panel using these credentials.
- Accessed the admin panel.
Prevention Techniques
- Use Strong Passwords.
- Limit Login Attempts.
- Monitor IP addresses.
- Use Two-Factor Authentication (2FA).
- Use CAPTCHAs.
- Use Unique Login URLs
- Disable Root SSH Logins
- Use Web Application Firewalls (WAFs)
ALGORITHMICALLY RELATED
Similar Open-Source Projects
Selected from shared topics, language and repository description—not editorial ratings.
★ 3