basicbuster

basicbuster is a command-line tool for testing HTTP Basic Authentication with username and password wordlists. It detects Basic Auth on a target URL, runs pitchfork or clusterbomb-style attempts, and reports credentials that return HTTP 200.

Disclaimer

Use only on systems and applications you are explicitly authorized to test. Unauthorized access to computer systems is illegal. The authors are not responsible for misuse.

Installation

pip install basicbuster

Usage

basicbuster --url URL (--username FILE --password FILE | --userpass FILE) [OPTIONS]

Options

Examples

Clusterbomb (default — all username x password combinations):

basicbuster --url https://example.com/secret --username users.txt --password passwords.txt -v

Pitchfork (pair line-by-line):

basicbuster --url https://example.com/secret --username users.txt --password passwords.txt --mode pitchfork -v

Combined user:pass file:

basicbuster --url https://example.com/secret --userpass combo.txt -v

With proxy and 20 threads:

basicbuster --url https://example.com/secret --userpass combo.txt --proxy http://127.0.0.1:8080 -t 20 -v

Output

[*] Target appears to use HTTP Basic Auth: https://example.com/secret
[*] Testing 400 credential pair(s) with 10 thread(s)…

[1/400] [-] admin:password → HTTP 401
[2/400] [-] admin:123456 → HTTP 401
[3/400] [+] admin:secret → HTTP 200 ✓ SUCCESS
...

Sample wordlists (20 common entries each) are included in samples/.

License

MIT — see LICENSE.