creds_helper previously hardcoded BruteforceConfig.max_retries = 1. 'setg
bruteforce_retries N' now sets the per-combo retry count for retryable
(transient/connection) errors; unset or 0 keeps the historical default of 1.
show options: + bruteforce_retries. Build: 0 errors, 0 warnings.
- bruteforce_mask (hydra -x): 'setg bruteforce_mask MIN:MAX:CHARSET' enumerates
candidate passwords. CHARSET placeholders mirror hydra: a->a-z, A->A-Z, 1->0-9;
any other char is literal. e.g. '1:4:a1' = 1-4 chars of [a-z0-9]. Generated via
an odometer counter, hard-capped at MAX_COMBOS with a warning. Mask candidates
run AFTER the wordlist (lowest yield); skipped in credential_file_only mode.
New: utils::bruteforce::generate_mask_passwords + creds_helper wiring.
- bruteforce_resume (batch-level): 'setg bruteforce_resume y' makes a streamed
large-wordlist run record the last fully-completed 500k batch, keyed by
target+port+wordlist+size+mode, under ~/.rustsploit/checkpoints/<key>.bfr. An
interrupted run skips already-tried batches on restart and clears the marker on
clean completion / first success. New checkpoint markers: read/write/clear_
bruteforce_marker, mirroring the existing seq-marker pattern.
show options: + bruteforce_mask / bruteforce_resume. Build: 0 errors, 0 warnings.
- Cross-batch give-up: run_bruteforce split into a wrapper + run_bruteforce_with_abort
taking a shared abort flag; the streaming driver reuses one flag so a host the
engine gives up on stops the WHOLE run instead of re-pausing every 500k batch.
- credential_file_only: 'setg credential_file_only y' makes the combo file the
ONLY credential source (exact hydra -C; ignores user/pass wordlists + streaming).
- cred_stop_mode (host|user|all): host = stop whole host on first success
(default); user = stop a username once its password is found, keep other users
(medusa); all = find every valid credential (hydra default). Engine reads the
setg (no BruteforceConfig field change -> no ripple across 14 callers).
show options: + credential_file_only / cred_stop_mode. Build: 0 errors, 0 warnings.
1. Batch concurrency cap: in a mass-scan fan-out, per-host bruteforce concurrency
is capped (4) so it no longer multiplies with scheduler host-concurrency into
an RLIMIT_NOFILE-exhausting socket count.
2. Combo-file (hydra -C): 'setg credential_file <user:pass file>' is loaded via
the engine's load_credential_file and tried alongside defaults. Verified:
2-pair file -> +2 attempts.
3. Delay/jitter (hydra -w): 'setg bruteforce_delay_ms' + 'setg bruteforce_jitter_ms'
now feed BruteforceConfig.delay_ms/jitter_ms (were hardcoded 0).
4. Host give-up (medusa): run_bruteforce now aborts a host after MAX_LOCKOUT_PAUSES
(3) consecutive-error lockout pauses with no success, instead of pausing-and-
grinding forever. run_subnet_bruteforce already had give-up.
Also surfaced credential_file/bruteforce_delay_ms/bruteforce_jitter_ms in
'show options'. Build: 0 errors, 0 warnings.
Known limitation: streaming-path give-up is per-batch (not cross-batch).
Adds the highest-yield hydra feature to the shared creds_helper: for each
username, optionally also try an empty password (null), the username as its own
password (same), and the reversed username. Opt-in via 'setg cred_extras' with a
subset of n/s/r (e.g. nsr); default off. Appended to the defaults-first rows so
they run before the wordlist; the engine's existing combo dedup avoids retrying
a pair already in defaults. Skipped for password-only services.
Also surfaced username_wordlist/password_wordlist/cred_extras in 'show options'.
Verified: elasticsearch_bruteforce + cred_extras=nsr + 1 username -> 6 defaults +
null + reversed (same deduped against the admin/admin default) = 8 attempts.
creds_helper required a password wordlist (cfg_prompt_existing_file with no
default), so in a mass scan with no 'setg password_wordlist' every host errored
'Missing required prompt key' before the module's built-in DEFAULTS were ever
tried — making bruteforce sweeps look stuck/broken (the RTSP report). Wordlists
are now OPTIONAL when the module ships defaults: a missing wordlist falls back to
defaults-only instead of erroring. Modules with no defaults (postgres/mysql/snmp)
still require a wordlist. Verified: batch-mode elasticsearch_bruteforce with no
wordlist runs its 6 defaults and completes (was: error).
First run (or a clean ~/.rustsploit) has no history file; a NotFound on
rl.load_history is normal and was printing '[!] Failed to load history: No such
file or directory'. Now NotFound is logged at debug; only real failures
(permissions, corruption) are surfaced loudly.
added api support migrated some other stuff to native modules for speed and also because some of them are not getting updates etc UWU also fixed bugs and also check changelog for info
migrated away from free rdp lots of improvements there and created native libs feel free to use native libs but contribute if you improve please add more wider api support and cli and shell payload mutator for api endpoint going to do that for payloads gens and other stuff later and im also planning some more bug changes and improvement check the api template
added my to do list this is a backup of progress so far fixed alot fo stuff check change log redisgning the way api runs and works fixing modules ooms adding extra security on prompt handling change some stuff this version is not stable yet so please do be aware
s-b-repo