How to: Brute Force
https://github.com/vanhauser-thc/thc-hydra
# Number one of the biggest security holes are passwords, as every password security study shows. This tool is a proof of concept code, to give researchers and security consultants the possibility to show how easy it would be to gain unauthorized access from remote to a system.
```hydra -l root -P 10-million-password-list-top-1000.txt www.example.com -t 4 ssh```

https://www.openwall.com/john/
# John the Ripper is an Open Source password security auditing and password recovery tool available for many operating systems.
```unshadow /etc/passwd /etc/shadow > mypasswd.txt```
```john mypasswd.txt```

https://hashcat.net/hashcat/
# Hashcat is a password recovery tool.
```hashcat -m 0 -a 0 hashes.txt passwords.txt```

https://github.com/iangcarroll/cookiemonster
# CookieMonster is a command-line tool and API for decoding and modifying vulnerable session cookies from several different frameworks. It is designed to run in automation pipelines which must be able to efficiently process a large amount of these cookies to quickly discover vulnerabilities. Additionally, CookieMonster is extensible and can easily support new cookie formats.
```cookiemonster -cookie "gAJ9cQFYCgAAAHRlc3Rjb29raWVxAlgGAAAAd29ya2VkcQNzLg:1mgnkC:z5yDxzI06qYVAU3bkLaWYpADT4I"```

https://github.com/ticarpi/jwt_tool
# jwt_tool.py is a toolkit for validating, forging, scanning and tampering JWTs (JSON Web Tokens).
```python3 jwt_tool.py eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJsb2dpbiI6InRpY2FycGkifQ.aqNCvShlNT9jBFTPBpHDbt2gBB1MyHiisSDdp8SQvgw```

https://github.com/ustayready/fireprox
# Rotate the source IP address in order to bypass rate limits

https://github.com/AethliosIK/reset-tolkien
# This tool is the result of research into "Unsecure time-based secrets" from this article: https://www.aeth.cc/public/Article-Reset-Tolkien/secret-time-based-article-en.html.
# To better understand how to use this tool, we strongly recommend that you read it first.

https://portswigger.net/research/introducing-signsaboteur-forge-signed-web-tokens-with-ease
# Signed web tokens are widely used for stateless authentication and authorization throughout the web. The most popular format is JSON Web Tokens (JWT) which we've already covered in depth, but beyond that a diverse ecosystem of standards thrives, each with its own implementation of data storage and security.
# To help assess these, we've released a new open source extension for Burp Suite called SignSaboteur. This tool is designed to automate the attacks discussed here, ensuring that you no longer overlook any insecure configurations.

https://github.com/intruder-io/guidtool
# A simple tool to analyse version 1 GUIDs/UUIDs from a system. With the information obtained from analysis, it is often possible to forge future v1 GUIDs created by the system, if you know the approximate time they were created.
```guidtool -t '2022-04-13 09:12:54' 95f6e264-bb00-11ec-8833-00155d01ef00```

https://portswigger.net/research/turbo-intruder-embracing-the-billion-request-attack
# In this presentation I introduce, demo and distribute Turbo Intruder - a research grade open source Burp Suite extension built from scratch with speed in mind. I also discuss the underlying HTTP abuse that enables it to go so fast, so you can attain similar speeds in any tools you happen to write.