-00ffff?style=for-the-badge&labelColor=0d1117){kind=icon}
SharkBruteforce is a modular, terminal-driven credential auditing engine that weaponizes the legendary THC-Hydra engine along with native PDF-cracking fallbacks. It is built for authorized penetration testers, CTF players, and security students who need a clean, fast, and reliable way to audit weak credentials on:
- 📷 IP Cameras (HTTP Basic Auth)
- 🌐 Web Admin Panels (HTTP Form Auth)
- 📄 Password-Protected PDFs (pdfcrack / John the Ripper / pikepdf)
Every attack runs through multi-backend auto-fallback, so if one cracker is missing, Shark jumps to the next — zero manual config. 🎯
┌──────────────────────────────────────────────┐
│ $ whoami │
│ > technicalsuraj2 (Suraj Patel) │
│ $ id │
│ > uid=1337 gid=1337 groups=1337(offense) │
│ $ cat /etc/role │
│ > Ethical Hacker & Developer │
│ > Founder @ AGSC Developer │
│ > Location: India 🇮🇳 │
└──────────────────────────────────────────────┘
Suraj Patel (technicalsuraj2) is an ethical hacker and Python developer from India who builds cutting-edge offensive security tooling — engineered for power, built for education. He believes the sharpest defenses come from studying the sharpest offenses. Every tool he ships is designed to teach, expose weak spots, and raise security awareness — never to harm.
🏆 Arsenal so far: Eagle Eyes Pro · SharkBruteforce · Subfinder · Rootlock · DarkDomainFinder · Wifibruteforce & more.
| Feature | Details |
|---|---|
| 🎯 Three attack vectors | IP Camera · Web Admin · PDF brute force |
| ⚙️ Hydra-powered | Industry-standard THC-Hydra under the hood |
| 🔄 Auto fallback | pdfcrack → John the Ripper → pikepdf |
| 📦 Auto dependency install | Hydra auto-installs on Linux |
| 📚 Auto wordlist fetch | Downloads full rockyou.txt (~133 MB) if missing |
| ✅ Input validation | URL, file-existence & path sanitization |
| ⏹️ Graceful interrupts | Clean Ctrl+C handling, no half-broken states |
| 🧵 Cross-platform | Kali · Ubuntu · Debian · Windows (WSL2) |
| 🖥️ Professional UI | Red/cyan terminal theming ready for screen-demo |
| Dependency | Purpose | Install |
|---|---|---|
| Python 3.x | Core runtime | Pre-installed on Kali/Ubuntu |
| THC-Hydra | Camera & web brute force | sudo apt install hydra (auto-installs) |
| pdfcrack / john (optional) | PDF cracking backends | sudo apt install john pdfcrack |
| pikepdf (fallback) | Pure-Python PDF cracker | pip install pikepdf |
| rockyou.txt | Default wordlist | Auto-downloaded on first run |
| Network access | Wordlist download / targets | Standard |
sudo apt update && sudo apt install -y python3 python3-pip git hydra john
git clone https://github.com/technicalsuraj2/SharkBruteforce.git
cd SharkBruteforce
pip3 install -r requirements.txt
python3 sharkbruteforce.py# WSL2 (Kali/Ubuntu): same commands as above
# Termux:
pkg update && pkg upgrade
pkg install python git hydra
git clone https://github.com/technicalsuraj2/SharkBruteforce.git
cd SharkBruteforce
pip install -r requirements.txt
python sharkbruteforce.py💡 On Windows without WSL, install THC-Hydra manually — PDF cracking still works via
pikepdf.
python3 sharkbruteforce.py┌────────────────────────────────────────────────────────────┐
│ 🦈 SELECT ATTACK MODE 🦈 │
├────────────────────────────────────────────────────────────┤
│ [1] Camera Login Brute Force → IP Camera URL + lists │
│ [2] Web Admin Panel Brute Force → Web URL + lists │
│ [3] PDF Password Brute Force → PDF path + wordlist │
│ [4] Exit │
│ [5] Go to Author GitHub │
└────────────────────────────────────────────────────────────┘
$ 1
Camera IP URL: http://192.168.1.100:8080
Username wordlist: users.txt
Password wordlist: rockyou.txt
[*] Starting Camera Brute Force on 192.168.1.100:8080
[*] Service: http-get
[✓] Credentials acquired → admin / admin@123$ 2
Web Admin URL: https://example.com/admin
Username wordlist: users.txt
Password wordlist: rockyou.txt
[*] Starting Web Admin Brute Force on example.com:443
[✓] Credentials acquired → root / root123$ 3
PDF file path: /home/suraj/encrypted.pdf
Password wordlist: rockyou.txt
[*] Trying pdfcrack → [fallback] John → [fallback] pikepdf
[✓✓✓] PASSWORD FOUND: secret@2024This tool is provided strictly for EDUCATIONAL PURPOSES and AUTHORIZED SECURITY TESTING ONLY.
- ✅ Use it only on your own systems, lab environments, or targets you have explicit written permission to test.
- ❌ Unauthorized access to devices, networks, or accounts you do not own is illegal in most jurisdictions.
⚠️ The author takes no responsibility for any misuse of this software. You alone are accountable for how you use it.- 🛡️ The purpose of this project is to raise awareness and help the security community harden their defenses — not to break the law.
By downloading/using this tool, you agree to use it ethically and legally. Stay on the right side of the law. 🦈
| Parameter | Mode | Example |
|---|---|---|
Camera IP URL |
1 | http://192.168.1.100:8080 |
Web Admin URL |
2 | https://example.com/admin or /login.php |
PDF file path |
3 | /path/to/encrypted.pdf |
Username wordlist |
1, 2 | /path/users.txt |
Password wordlist |
1, 2, 3 | rockyou.txt (auto) |
SharkBruteforce/
├── sharkbruteforce.py # Main tool (single-file, zero bloat)
├── requirements.txt # Python dependencies
├── LICENSE # MIT license
├── README.md # You are here
├── .gitignore # Ignores rockyou.txt & caches
└── assets/
└── demo.gif # Animated demo
- 🦈 Camera & web brute force (Hydra)
- 📄 PDF multi-backend cracking
- 📚 Auto
rockyou.txtdownloader - 🌐 Full form-field mapper (auto-detect login form)
- 🧠 AI-assisted password candidate generation
- 📊 Session logging & reports (CSV/HTML)
- ⚡ Multi-threaded config tuning presets
╔═══════════════════════════════════════════════════════════╗
║ 🔐 FOR ETHICAL SECURITY AND AUTHORSED TESTS ONLY 🔐 ║
║ 🦈 SHARK BRUTEFORCE 1.0 🦈 ║
║ Built with 💀 by technicalsuraj2 ║
╚═══════════════════════════════════════════════════════════╝
⭐ Show love — star the repo, fork, and share responsibly.
Made with ⚡ by technicalsuraj2 · AGSC Developer