password-authentication

bySue mackin

Input Target you control Test username(s) A locally generated test password list Optional concurrency settings Candidate generator Generates or reads candidate passwords. Common approaches are dictionary, rule-based, and exhaustive combinations. Attempt engine Sends each candidate to a deliberately vulnerable local test authentication service. Records whether the laboratory service accepts or rejects it. Response analyzer Determines success/failure from the controlled test application's response. Real-world tools can use HTTP status codes and response contents, although relying on only status codes can produce false positives. Concurrency/queue A worker pool processes candidates. A central queue tracks pending, successful, and failed attempts. Results Attempts/second Number tested Successful laboratory credential Error counts Runtime/logs