A scriptable network authentication cracker for custom services, using Lua scripts to test credentials.
authoscope is a scriptable network authentication cracker built for testing custom authentication services. It solves the problem of having to write custom Python scripts for bruteforcing credentials in web applications, proprietary protocols, or other non-standard services by providing a Lua-based scripting runtime. The tool handles concurrency, progress reporting, and result aggregation while users focus on defining the verification logic.
Security researchers, penetration testers, and red teamers who need to test custom authentication mechanisms in web applications, internal services, or proprietary systems.
Developers choose authoscope over generic bruteforce tools because it offers scriptable flexibility for custom services, built-in concurrency and reporting, and a rich set of built-in functions for HTTP, databases, and LDAP—all in a single Rust-based tool.
Scriptable network authentication cracker
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Allows writing custom `verify(user, password)` functions in Lua to test any authentication mechanism, as demonstrated in the example script for web logins with CSRF tokens.
The runtime automatically handles parallel execution, progress tracking, and result aggregation, freeing users from managing threads or queues manually.
Includes HTTP sessions, form handling, CSRF parsing, JSON, and raw socket communication, evidenced by functions like `http_mksession`, `html_select`, and `sock_connect`.
Provides direct functions for MySQL and LDAP authentication testing, such as `mysql_connect` and `ldap_bind`, reducing the need for external tools.
Offers `print()` and `oneshot` mode for script development, making it easier to troubleshoot authentication logic during testing.
Requires learning and writing Lua scripts, which can be a hurdle for teams used to Python; the README admits the runtime is 'bare bones,' necessitating Python wrappers for complex tasks.
Building from source requires Rust and `libssl-dev`, with multi-step instructions for Debian, making setup more cumbersome than binary packages for some users.
Focuses on custom services, so users must write their own scripts for each target, unlike tools with extensive, community-maintained module libraries.
Entirely command-line and script-based, which may not suit security testers who prefer graphical tools for easier workflow management.
badtouch is an open-source alternative to the following products:
THC-Hydra is a fast and flexible network login cracker that supports numerous protocols to test authentication security through brute-force attacks.
Ncrack is a network authentication cracking tool designed to test the security of network services by brute-forcing credentials.
An open-source headless commerce platform built with Node.js, providing a flexible foundation for creating custom e-commerce solutions.