A fast, multi-protocol credential brute-forcer that parses Nmap, Nessus, and Nexpose output to test credentials across 30+ services.
Brutespray is a command-line security tool written in Go that automates credential brute-forcing across network services. It parses output from scanners like Nmap, Nessus, and Nexpose to automatically test default and custom usernames and passwords on over 30 protocols, helping security professionals identify weak credentials during penetration tests.
Security researchers, penetration testers, and red teamers who need to efficiently test for weak credentials across a large number of services discovered during network reconnaissance.
Developers choose Brutespray for its speed, parallel processing, and direct integration with popular scanning tools, which eliminates manual data conversion. Its interactive TUI, embedded wordlists, and resume capabilities provide a robust and user-friendly experience for sustained brute-forcing engagements.
Fast, multi-protocol credential brute-forcer. Parses Nmap, Nessus, and Nexpose output to automatically test default and custom credentials across 30+ protocols.
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Covers over 30 protocols including SSH, FTP, RDP, and HTTP, as listed in the services documentation, enabling broad credential testing from a single tool.
Directly parses Nmap GNMAP/XML, Nessus, and Nexpose files, automating the transition from reconnaissance to credential attack without manual data handling.
Features a tabbed TUI with live monitoring and pause/resume functionality, providing real-time control during long brute-forcing sessions.
Includes dynamic threading, rate limiting, and circuit breakers, optimized for efficient and resilient network attacks as detailed in the advanced tuning guide.
Requires familiarity with numerous CLI flags and YAML config files, which can be overwhelming for users accustomed to point-and-click security tools.
Depends entirely on external scanner output; cannot perform port or service discovery on its own, limiting standalone utility in some scenarios.
Lacks advanced evasion techniques; brute-forcing activities are inherently noisy and can easily trigger security alerts on monitored networks.