Build a Brute Force Attack Simulator and Defense Analyzer

Brute force and credential stuffing attacks are among the most common threats to login systems. Simulating them in a controlled environment helps evaluate how effective current protections like rate limiting, CAPTCHA, or lockout policies truly are.

This project enables ethical simulation of brute force attacks on test environments. It measures how fast login systems respond, how defenses trigger, and how long an attacker can keep guessing before being blocked — providing insights for stronger security design.

The tool mimics a brute force bot by sending a series of login attempts using a username and a list of passwords. It observes how and when the login system responds with blocking measures, errors, slowdowns, or CAPTCHA requests, then analyzes its performance.

• Input: target login URL, test credentials, and password list.
• Simulator starts sending automated POST requests to login form.
• Captures responses, error codes, delays, and defense triggers like CAPTCHA or lockout.
• Scores the effectiveness of defenses using metrics like time-to-block, number of allowed guesses, etc.
• Generates a report with charts and suggestions to improve login protection.

• OWASP Authentication Cheat Sheet
• Rate Limiting with Express.js
• Python Requests Library
• rockyou.txt (Common Passwords)
• Chart.js for Data Visualization