Brutus: Modern Credential Attack Testing

Brutus v1.0 is here, and it's about to change how you approach credential testing on every engagement.

We've all been there. Thousands of discovered services, and now you need to audit credentials at scale. But first — dependency hell, compilation errors, and parsing scripts for output no machine can process. An hour gone before you've tested a single credential.

That era is over.

Brutus is what credential testing should look like in 2026. Written in Go, fully open source, and now available in the Praetorian Guard Platform. There's no black box here — every line of code is auditable, extensible, and community-driven. It compiles to a single binary with absolutely zero external dependencies. Download it, run it, done. No development headers, no package managers, no compilation nightmares. It runs everywhere — Linux, macOS, Windows, FreeBSD — and it speaks JSON natively because your pipeline shouldn't need a translator.

Brutus is a manually initiated capability within the Praetorian Guard Platform. To ensure this powerful tool is deployed at the right time and against the right systems, coordinate with your Praetorian Guard team to scope and authorize credential testing as part of your engagement workflow.

Seamless Pipeline Integration

Here's where Brutus truly shines. Your reconnaissance output pipes straight into credential testing in a single pipeline:

naabu -host 10.0.0.0/16 -silent | fingerprintx --json | brutus --json

That's it. Port scan to service identification to credential testing. Structured JSON results flow out the other end, ready for your reporting pipeline, your database, or your next tactical decision — no parsing scripts required.

23 Protocols and Counting

Brutus ships with support for SSH (passwords and private keys), MySQL, PostgreSQL, MSSQL, Redis, MongoDB, SMB, LDAP, WinRM, SNMP, FTP, Telnet, VNC, HTTP/HTTPS Basic Auth, and more. Each protocol is implemented as a self-contained plugin, which means the architecture is built to grow with the community.

TLS Support

Brutus supports configurable TLS modes across database and directory plugins. The following table shows how Brutus TLS modes map to each plugin's underlying connection parameter.

The PostgreSQL plugin fully honors the Brutus TLS mode configuration, bringing it in line with the MySQL, MSSQL, Neo4j, and LDAP plugins. This means PostgreSQL servers that require TLS — a common configuration in production environments — can now be tested without any workaround.

To specify a TLS mode, pass the --tls flag when invoking Brutus:

brutus --tls verify --json

GitHub Active Email Enumeration

The enum active github module checks whether email addresses are registered GitHub accounts by interacting with GitHub's signup flow. This module is particularly useful for correlating discovered email addresses with GitHub identities during an engagement.

brutus enum active github --rotating-proxy <proxy-url> [emails...]

Named enumeration results

When Brutus generates usernames from a frequency-ranked wordlist, it now retains and propagates the first and last name that produced each candidate throughout the enumeration pipeline. Every Result carries First and Last fields populated at generation time, so the full identity signal is preserved without requiring downstream consumers to reverse-derive names from local parts — a step that is unreliable for initial-based username formats.

Generated names are carried through the GitHub oracle and emitted in JSONL output alongside account existence and username, giving you a richer, ready-to-use identity record for each confirmed result.

Rotating proxy support

GitHub's signup endpoint rate-limits and blocks requests by IP. Running enumeration through a rotating proxy is the recommended approach for reliable results at scale. The module handles this configuration as follows:

• CSRF session establishment — The initial GET to the signup page sends the required Accept header, which resolves the HTTP 403 that previously prevented any account check from completing.
• Per-email 403 retry — In addition to retrying on HTTP 429 (rate limit), the module now also retries on HTTP 403. Keep-alive is disabled so each retry opens a fresh connection and obtains a new proxy exit IP, allowing the rotation to recover from a blocked address automatically.
• Session progress indicator — A progress indicator emits status during the initial session setup phase. If proxy handshakes are slow, the indicator distinguishes an in-progress setup from a hang.

These fixes restore reliable operation when using rotating proxies, which is the common field configuration for this module.

Embedded Bad Keys — Because Nobody Should Still Be Using Vagrant Keys in Production

This one's a game-changer. Brutus compiles known-compromised SSH key collections directly into the binary — keys from Rapid7's ssh-badkeys repository, HashiCorp Vagrant, F5 BIG-IP, ExaGrid, Ceragon FibeAir, and others. When Brutus encounters an SSH service, it automatically tests every embedded bad key against the service. No key files to manage, no wrapper scripts to maintain, and each key carries its CVE metadata straight through to the output for your compliance reporting.

Spray That Compromised Key Across the Network

Found a private key on a compromised vulnerability scanner? Brutus turns what used to be an afternoon of bash scripting into a repeatable one-liner. Point it at a network range with the recovered key, and within minutes you'll have a complete map of everywhere that key grants access — across network segments, across hosts, with clean JSON output that lets you plan your lateral movement with precision.

Experimental: AI-Powered Credential Discovery

We couldn't resist pushing the envelope. Brutus ships with experimental AI features that tackle one of the most tedious parts of internal assessments — landing on an unknown HTTP admin panel and having no idea what default credentials to try.

The first feature sends HTTP response data to an LLM that identifies the application (Grafana, Jenkins, Tomcat, a Cisco management interface, you name it) and suggests vendor-specific default credentials. The second feature goes even further — using headless Chrome combined with Claude's vision API to navigate JavaScript-rendered login pages, identify the appliance from a screenshot, research default credentials, and fill in the form automatically.

These features are experimental and depend on external API services, but the early results from our own engagements have been genuinely exciting.

Reliability Improvements

The following behavioral fixes are in effect as of this release:

• Negative thread count clamped — passing a negative value for --threads no longer produces unbounded concurrency; the value is clamped to the configured default.
• Panic results no longer dropped — worker pool panics are now always recorded in results rather than silently discarded when the result mutex was contended.
• POP3: PASS no longer sent after USER rejection — when a server returns -ERR to the USER command, the PASS command is no longer issued, matching RFC 1939 and preventing misleading wire traffic.

RDP logon-screen backdoor detection

Credential testing does not catch accessibility-tool backdoors at the Windows RDP logon screen. A sticky-keys (sethc.exe) or Utilman replacement persists after password rotation and is reachable by any unauthenticated user with network access to the RDP port.

Guard's logon-backdoor check runs pre-authentication against in-scope RDP ports (default TCP 3389). The Brutus agent dispatches it independently of credential testing. It files a Critical finding (CVSS 4.0 9.3, CWE-912, ATT&CK T1546.008) when a replacement is corroborated. No credentials, agents, or extra configuration are required.

When a finding is raised: verify the substitution, restore known-good binaries, treat the host as previously compromised, and audit other RDP-exposed hosts.

Why "Brutus"?

If you know Praetorian's tooling, you'll notice we tend to name projects after Roman emperors — Trajan, Augustus, and the like. Brutus breaks that tradition because Marcus Junius Brutus was never an emperor. He's remembered for walking into the Roman Senate on the Ides of March and putting a dagger in the back of the most powerful man in the world. That felt more appropriate for a credential testing tool than any emperor's name ever could. Brutus doesn't build empires — it tests whether the ones you've built will let a stranger walk right through the front door.

Besides, "Et tu, default creds?" was too good to pass up.

Get Started Now

Brutus is open source and ready for your next engagement. The full source is available on GitHub — inspect it, extend it, contribute to it. To get Brutus running as part of your Praetorian Guard deployment, reach out to your Praetorian Guard team to coordinate activation and scoping.

go install github.com/praetorian-inc/brutus/cmd/brutus@latest

The next time you're holding a private key from a compromised scanner and wondering where it works, you won't need a bash for-loop and three hours of patience. You'll need one binary and one pipeline.