Target Configuration
Set the target URL where the login form resides. Provide a single username or point it to a text file list. Do the same for the password (or load custom wordlists via Browse).
Tell the engine what text confirms a failed login (e.g., Invalid password) or successful login (e.g., Welcome) so it can report hits accurately.
Dashboard & Console
Once you click Start Attack, the dashboard displays live metrics: elapsed time, attempts speed, ETA, hits (successes), attempted count, and any rate-limit errors.
The Console Output at the bottom streams detailed live logs explaining exactly what background tasks are doing.
Browser Mode (Selenium)
Uses a real browser in the background. It mimics actual user keyboard actions and clicks. Ideal for modern, complex websites that rely heavily on JavaScript.
HTTP Mode (Hydra-style)
Bypasses the browser interface and sends network packets directly. It runs up to 100x faster. Great for legacy portals, API endpoints, and raw speed testing.
Spray Mode
Instead of testing thousands of passwords against one username (which locks accounts), Spray Mode tests a single password against a list of multiple users. Safely bypasses lockout thresholds.
CUPP Generator
Generates target-specific password guesses based on personal profiles. Input a user's details (names, birthdates, pet names, company details, keywords) and CUPP automatically compiles a smart custom wordlist applying common formatting styles.
Sequence Generator
Quickly generates numeric sequence ranges (e.g. 0000 to 9999) with customizable prefixes (like user_) or suffixes (like @gmail.com). Ideal for pin code or indexed username profiling.
Tor & Proxy
Enable Tor to route your traffic anonymously. Set it to shift identity after N attempts to automatically obtain a fresh IP address. You can also supply custom proxy lists.
Targets Queue
Queue multiple sites to be audited sequentially. Set up a target, add it to the queue, configure the next one, and start them all with one click.
Attack Scheduler
Schedule audits to run at a specific future date/time so they run automatically during maintenance or low-traffic windows.
Alerts (Discord & Telegram)
Supply Discord webhook URLs or Telegram bot tokens. The framework will instantly message your chat when a valid login is discovered.