[FastFive]

i have a script to bruteforce accounts on a website login form, there is no captcha ever. the "too many invalid login" message is IP based and happens after about 10 failed logins from the same ip.

heres what ive tried -NOT WORKING(in this case):
- after every failed login, do a working login using my own account
- changing headers randomly
- with and without cookies

now, possible solutions i have thought of
1) trick the website's idea of my I.P. (no idea how to do this,. basically how to spoof ip for an http request)
2)use proxies (not realistic as i am going to do 10k passwords x ~50 accounts)
3)rotate IPs using vpn that has about 10 countires (going to try this one shortly...) but i doubt it will work

but i welcome any other advice, and if it works to my satisfaction ill send you one(1) bitcoin immediately

[derpdiggler]

Well if you are on windows, proxifier will work with tor, if on linux proxychains will do the trick with tor as well.
You are on the right track clearing cookies, they could use that as well.
Tor automatically changes IP every 15 minutes or so I forget exactly, you can change that but again this is OS dependent, so what OS are you using?

No vulnerabilities? Might be easier to just get the hashes.

[tired-]

If you have access to the code itself then try adding a few lines to let you use a proxy like the user above said.

If you can't do that I'm sure you can find something around with the search button.

[Dohxe]

Proxies would be your best bet in my opinion considering if you got 2k working proxies at 10 tries per proxy is 20k passwords checked, and by the time it finishes the list the first proxies used will most likely be ready to use again depending on how long the wait is after you get too many invalid logins.

[Just a Cracker]

If it's just a standard website login form, use a bruteforcer with proxies. Sentry is very good at what it does and if the site can be cracked, Sentry can do it.

[Krieg]

If the site checks certain headers (X-Forwarded-For, CF-Real-IP...) you could spoof those and it'd believe your IP had changed.
This is unlikely at best, though.

[FastFive]

Proxies would be your best bet in my opinion considering if you got 2k working proxies at 10 tries per proxy is 20k passwords checked, and by the time it finishes the list the first proxies used will most likely be ready to use again depending on how long the wait is after you get too many invalid logins.

yes that does seem practical, it is far from a perfect solution but i will use this as a last resort if everything else fails.

right now im going to play around with the time interval and with VPN switching ips,

i am on mac and my bruteforcing script cannot run over the tor network as of now (i have tried every available method on the web)

if there is a method that can circumvent this, that is what i am looking for. and will do some more searching now.

[FastFive]

anyone interested, i made a little script to check proxies
https://hackforums.net/showthread.php?tid=3729505