brutespray — The Cyber Toolchain

brutespray v2.7.2

Tue, 25 Aug 2026 17:50:43 GMT

brutespray v2.7.2 adds engagement manifests, deterministic dry-run planning, lockout-aware budgets, and authenticated audit chains • Adds `--dry-run` flag to resolve targets and credentials into deterministic JSON without performing any authentication attempts. • Adds `--plan-out` flag to write the full execution plan to a file for review, approval, or CI evidence. • Adds `--require-plan-ack` flag to require that the exact reviewed plan hash matches before execution proceeds; binds credential contents via keyed HMAC so same-sized credential-list substitutions invalidate the plan. • Adds `brutespray audit verify` subcommand requiring `BRUTESPRAY_AUDIT_HMAC_KEY`; missing or incorrect keys fail verification with a fail-closed exit. • Adds `evidence.hmac_key` field in the engagement manifest as a required key for acknowledged execution and audit-chain verification. • Adds `lockout_threshold`, `lockout_window`, `safe_margin`, and `jitter_percent` policy controls in engagement manifests for lockout-aware attempt budgets, with shared scheduling across worker pools. • Adds engagement manifests (YAML) carrying engagement identity, authorization references, scope, lockout policy, and evidence defaults. • Adds allow/deny scope controls — host and CIDR allowlists plus explicit deny rules applied before execution; rejected targets appear in dry-run output with stable reasons. • Adds evidence modes `full`, `redacted`, `hash`, and reserved `encrypted` for machine-readable credential output; `hash` mode emits HMAC-SHA256 correlation values without printing the secret. • Adds JSONL workspace store for durable engagement records without requiring CGO or an external database, with new workspace command paths for initialization and inspection. • Adds declarative YAML HTTP auth templates describing HTTP/API authentication flows without enabling arbitrary shell execution; invalid or unsafe templates fail before network execution. • Adds a canonical service descriptor registry covering default ports, aliases, credential modes, routing support, module parameters, stability, and wordlist aliases. • Adds token-aware execution for InfluxDB v2 — tokens are attempted once per token without multiplication across default usernames; use `-m mode:v1` to preserve username/password pair generation. • Normalizes lockout-budget account identities to `service|domain|user` across worker pools instead of resetting per goroutine. • Adds authenticated audit chains using HMAC-SHA256 chaining instead of a recomputable plain hash; sensitive artifacts (checkpoints, session logs, stores, audit files) use owner-only permissions. Breaking changes: • `--require-plan-ack` requires an engagement manifest with `evidence.hmac_key` set; executions using plan acknowledgment without this key will fail closed. • `brutespray audit verify` requires the `BRUTESPRAY_AUDIT_HMAC_KEY` environment variable; missing or incorrect keys cause verification to fail. • `-P` is now a strict print-and-exit operation in the shared `Execute` path; any setup that relied on `-P` continuing into credential attempts will no longer do so. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/brutespray

brutespray v2.6.3

Sun, 28 Jun 2026 20:40:40 GMT

brutespray v2.6.3 adds operator diagnostics, attempt status taxonomy, module panic recovery, and smarter skip/resume/scheduling controls. • Adds `--debug-audit` and `--debug-file` flags to write per-attempt JSONL diagnostics with passwords redacted and credential substrings scrubbed from error text. • Adds `--route-diagnostics` flag to print selected local/source route info per target (interface, bound local IP, proxy context); disables TUI so output stays visible. • Adds `--module-help ` flag to introspect default port, credential mode, module params, and wrapper gating for any protocol module. • Adds `--skip-policy auto|off|conservative|aggressive` and `--max-conn-fails` to tune when repeated connection failures skip a host/service. • Adds `--schedule auto|host-major|spray|pairwise` to control credential queue ordering for deterministic or spray-style execution. • Introduces stable machine-readable attempt status codes (`auth_success`, `auth_failure`, `connection_failure`, `unsupported_service`, `module_timeout`, `module_panic_recovered`, `skipped_service`) propagated through JSONL output, session logs, TUI, and resume paths. • JSONL attempt output now includes an additive `status_code` field alongside the legacy `status` field. • Module boundary protection: panicking protocol modules are now caught and recorded as `module_panic_recovered` instead of crashing the entire run. • Timeout containment: modules that ignore context cancellation no longer block host completion; the attempt is recorded as `module_timeout`. • Granular checkpoint resume now uses a count-based per-host cursor to skip already-attempted queue prefixes on partially completed hosts. • Adds OpenAI-compatible research provider support for `wordlist research` via `WORDLIST_RESEARCH_PROVIDER`, `WORDLIST_RESEARCH_MODEL`, and `WORDLIST_RESEARCH_URL` environment variables (enables vLLM and similar endpoints). • RDP Sticky-Keys detection upgraded with broader `detectTerminalWindow` logic covering cmd.exe, PowerShell, and custom shell colors via pixel brightness delta and bounding-box fill analysis. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/brutespray

brutespray v2.6.3

Sun, 28 Jun 2026 20:40:40 GMT

brutespray v2.6.3 adds skip/schedule policies, debug audit logging, route diagnostics, module help, panic recovery, and stable attempt status codes. • Adds `--skip-policy auto|off|conservative|aggressive` and `--max-conn-fails` to tune when repeated connection failures cause a host/service to be skipped. • Adds `--schedule auto|host-major|spray|pairwise` to select deterministic credential queue ordering. • Adds `--debug-audit` and `--debug-file` to write per-attempt JSONL diagnostics with passwords and credential substrings redacted. • Adds `--route-diagnostics` to print selected interface, bound local IP, and proxy context per target (disables TUI so output stays visible). • Adds `--module-help ` to introspect default port, credential mode, module params, and wrapper gating for any protocol module. • Introduces stable machine-readable attempt status codes (`auth_success`, `auth_failure`, `connection_failure`, `unsupported_service`, `module_timeout`, `module_panic_recovered`, `skipped_service`) propagated through JSONL output, session logs, and TUI. • Adds module boundary protection: panicking modules are caught and recorded as `module_panic_recovered`; hung modules are capped and recorded as `module_timeout`. • Adds granular count-based per-host resume cursor so interrupted runs skip already-attempted queue prefixes on partially completed hosts. • Supports OpenAI-compatible endpoints (e.g. vLLM) for wordlist research via `WORDLIST_RESEARCH_PROVIDER`, `WORDLIST_RESEARCH_MODEL`, and `WORDLIST_RESEARCH_URL` environment variables. • Enhances RDP sticky-keys detection with broader `detectTerminalWindow` logic covering cmd.exe, PowerShell, and custom shell colors. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/brutespray

brutespray v2.6.2

Fri, 29 May 2026 17:45:14 GMT

brutespray v2.6.2 adds SSH bad-key detection, pre-auth RDP recon, stdin pipeline support, 5 new DB modules, SNMP tiering, and inline creds. • Adds SSH bad-keys pre-pass: embedded Rapid7 ssh-badkeys corpus (plus Vagrant, F5, Barracuda, and others) compiled into the binary, with CVE-tagged metadata and `BADKEY`/`type:badkey` output; controlled via `--no-badkeys` and `--badkeys-only`. • Adds pre-auth RDP recon (`brute.ScanRDPRecon`): X.224 NLA fingerprinting without authentication, plus sticky-keys backdoor detection (T1546.008) when NLA is not enforced; disable with `--no-rdp-scan`. • Adds stdin pipeline ingestion: auto-detects naabu, Nerva URI/JSON, fingerprintx JSON, and masscan `-oJ` formats when no `-f` or `-H` is supplied, enabling chains like `naabu | fingerprintx | brutespray`. • Adds five new database brute-force modules: CouchDB (5984), Elasticsearch (9200), InfluxDB (8086, v1/v2 via `-m mode:v1`), Neo4j (7687, Bolt v5), and Cassandra (9042, CQL native), bringing total service count to 41. • Adds SNMP community-string tiering via `-m mode:default|extended|full` (20/55/92 entries), with `full` covering SCADA, IP camera, and storage-array defaults. • Adds `-c`/`--creds` flag for inline credential pairs (`'user:pass,user2:pass2'`) without requiring a file. • Adds new TUI Findings tab populated from pre-auth recon results, color-coded by severity (`INFO`/`WARN`/`HIGH`/`CRITICAL`). • Adds `Finding` and `KeyMatch` fields to `BruteResult`, surfaced in text, JSONL (`type:finding`), and TUI output. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/brutespray

brutespray v2.6.1

Sun, 03 May 2026 14:02:37 GMT

brutespray v2.6.1 adds a `-delay` flag for intuitive per-attempt throttling in slow brute-force scenarios. • Adds `-delay` duration flag (e.g. `-delay 10s`) as an ergonomic alternative to fractional `-rate` values for slow brute-force scenarios. • Updates `-rate` help text to clarify fractional values are supported (e.g. `-rate 0.1` = one attempt every 10 s). • Adds `govulncheck` CI workflow scanning all Go dependencies against the Go vulnerability database on every push/PR and weekly. • Adds `dependency-review` action that blocks PRs introducing dependencies with known moderate-or-higher severity vulnerabilities. • Monthly wordlist update with new SMTP credential overrides. Breaking changes: • Using both `-delay` and `-rate` together exits with an error — they are mutually exclusive. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/brutespray

brutespray v2.6.0

Tue, 17 Mar 2026 20:36:09 GMT

brutespray v2.6.0 adds 12 new service modules, SSH key auth, CSRF extraction, SNMPv3, proxy rotation, and multi-auth support. • Adds 12 new service modules: SVN, SOCKS5-auth, HTTP-form, HTTPS-form, SMTP-VRFY, rexec, rlogin, rsh, wrapper, FTPS, LDAPS — bringing the total to 35+. • Supports SSH private-key authentication via `-m key:true -p /path/to/id_rsa`. • Enables automatic CSRF token extraction for HTTP-form attacks via `-m csrf:FIELD_NAME`. • Adds SNMPv3 user-based authentication with MD5/SHA and AES/DES privacy. • Supports multi-auth auto-detection: HTTP Digest/NTLM, SMTP PLAIN/LOGIN/NTLM, IMAP CRAM-MD5, POP3 APOP (from banner), and SMB pass-the-hash. • Introduces `--proxy-list` for round-robin rotation across multiple SOCKS5 proxies. • Adds SOCKS5 CONNECT handshake verification before handing off to modules. • Modules now capture and return server banners in `BruteResult`. • Supports database and domain parameters: MySQL/PostgreSQL `-m dbname:NAME`, MSSQL/RDP/SMB `-m domain:NAME`, Redis `-m db:N`. • Replaces default help output with a grouped, color-coded help menu organized by category. • Telnet module now recognizes login/password prompts in 10 languages including Chinese, Japanese, Korean, and Russian. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/brutespray

brutespray v2.5.5

Fri, 06 Mar 2026 18:29:37 GMT

brutespray v2.5.5 promotes RDP to stable, adds session replay on resume, and hardens credential handling for special characters and CRLF injection. • RDP support promoted from beta to stable. • Session replay on `--resume`: the full previous session is replayed into the TUI so the scan appears uninterrupted. • Ctrl+C now prints the exact `--resume` command needed to continue a session later. • Connection string escaping for credentials containing `@`, `:`, `;`, etc. across MongoDB, MySQL, PostgreSQL, MSSQL, and Oracle. • CRLF injection prevention: credentials are sanitized before embedding in Asterisk AMI, TeamSpeak, VMAuthd, and NNTP protocol streams. • New `docs/` folder with seven dedicated documentation pages covering installation, usage, services, examples, TUI, advanced options, and output. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/brutespray

brutespray v2.5.4

Fri, 06 Mar 2026 04:25:05 GMT

brutespray v2.5.4 adds an interactive TUI, embedded wordlists, LDAP/WinRM modules, credential spray mode, and resume support. • New default interactive TUI (Bubble Tea) with tabbed views: All, By Host, By Service, Completed, Successes, Errors, Settings; use `--no-tui` to revert to legacy output. • Live-adjustable threads-per-host and parallel-hosts settings during an active scan via the TUI Settings tab. • Real-time stats in TUI: elapsed time, attempts/sec, success rate, and error counts. • Embedded curated wordlists compiled into the binary via a YAML manifest — no external downloads required. • Automated monthly wordlist refresh pipeline with Brave Search integration. • New LDAP and LDAPS bruteforce module. • New WinRM bruteforce module. • Metasploit `.rc` resource script output via `-summary`. • NetExec/CrackMapExec shell script output via `-summary`. • Resume/checkpoint support: automatically saves progress on Ctrl+C; resume with `-resume`. • YAML config file support (`-config`) for per-engagement settings. • Per-host rate limiting via `-rate`. • SOCKS5 proxy support routed through a centralized ConnectionManager for all modules. • Interface binding (`-iface`) for VPN and multi-homed network setups. • RDP module upgraded with LoginAuthOnly() for fast NLA-only credential checking and full context/timeout support. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/brutespray

brutespray v2.4.2

Mon, 16 Feb 2026 21:55:53 GMT

Brutespray v2.4.2 adds Redis brute-force support including Redis 6.0+ ACL auth across all input formats. • Adds Redis brute-force module targeting port 6379, with support for Redis 6.0+ ACL username/password authentication. • Supports Redis targets across all input formats: GNMAP, JSON, XML, Nexpose, Nessus, and list files. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/brutespray

brutespray v2.3.1

Wed, 08 Jan 2025 20:25:38 GMT

brutespray v2.3.1 adds SOCKS5 proxy support, interface selection, and centralized connection management. • Adds SOCKS5 proxy support for routing credential-spray traffic through a proxy. • Adds interface selection option to control which network interface is used for connections. • Introduces centralized connection management for improved control over concurrent service connections. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/brutespray

brutespray v2.2.1

Tue, 27 Feb 2024 23:00:30 GMT

v2.2.1 adds `-P` flag to print found hosts, and support for XMPP, Teamspeak, and Oracle DB protocols • Adds `-P` CLI argument to print found hosts during scanning • Adds support for the XMPP protocol in service maps • Adds support for the Teamspeak protocol with adjusted timeout handling • Adds experimental support for Oracle DB detection Full history on Cyber Toolchain: https://cybertoolchain.io/tools/brutespray