A scriptable network authentication cracker for custom services, using Lua scripts to test credentials.
Authoscope is a scriptable network authentication cracker designed for security testing of custom services. It enables users to write Lua scripts that define a service's authentication logic, while the tool handles concurrency, progress tracking, and reporting. It specifically targets non-standard web applications or proprietary authentication protocols where existing tools like Hydra or Ncrack are insufficient.
Security professionals and penetration testers who need to test custom authentication mechanisms in web applications, proprietary services, or non-standard protocols. It is also suitable for developers writing their own credential testing scripts for unique authentication schemes.
Authoscope offers extensibility through Lua scripting, allowing users to rapidly test any authentication scheme without rewriting entire tools. Its built-in libraries for HTTP, LDAP, MySQL, sockets, and cryptography, combined with automatic concurrency management, provide a flexible and efficient alternative to generic bruteforce tools.
Scriptable network authentication cracker
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Enables writing custom `verify(user, password)` functions to handle any authentication flow, such as web logins with CSRF tokens, as shown in the detailed example script.
Includes libraries for HTTP, LDAP, MySQL, raw sockets, and cryptography, allowing testing of diverse services without external dependencies.
The runtime manages parallel credential attempts, improving efficiency in large-scale testing without manual thread handling.
Offers `print()` and `authoscope oneshot` for real-time script development and troubleshooting, though it may interfere with progress bars.
The README admits the runtime is minimal, often requiring users to wrap external Python scripts via execve for complex tasks, adding overhead.
Requires users to learn Lua and write custom scripts, which can be time-consuming compared to using tools with pre-configured modules for standard protocols.
Building from source necessitates Rust and libssl-dev, and detailed steps for Debian, which may be a barrier on systems without package managers like Arch's pacman.
authoscope is an open-source alternative to the following products:
THC-Hydra is a fast and flexible network login cracker that supports numerous protocols to test authentication security through brute-force attacks.
Ncrack is a network authentication cracking tool designed to test the security of network services by brute-forcing credentials.
An open-source headless commerce platform built with Node.js, providing a flexible foundation for creating custom e-commerce solutions.