AI-Augmented Series: AI Scripting for Brute-Forcing on a Web App Pentest
This blog was originally published by Andrew Trexler on the Raxis blog March 4, 2026 The other day I was on a web application penetration test . During testing I was going through the login functionality to check for common issues like account enumeration and vulnerability to a brute-force attack. Normally when doing these checks I capture the request with Burp Suite and then send it to the…
This blog post, originally published on March 4, 2026 by Andrew Trexler on the Raxis blog, describes how AI can be used to automate the process of brute-forcing a web application's login functionality. During a penetration test, the author encountered an issue with login requests expiring after a short time. By using AI to identify and reimplement the cookie generation function in Python, the author was able to create a script to perform a brute-force attack.
The post details the steps taken to set up a sample site, intercept the request with Burp Suite, and use AI to break down complex code and find the function responsible for generating the cookie. The AI was able to provide the code needed to replicate the cookie generation function, which was then reimplemented in Python. This process allowed the author to successfully perform the brute-force attack and obtain a 200 Success status code.
The author emphasizes the importance of not relying on client-side code for security controls and that any such controls must be implemented on the server-side to prevent exploitation. The post concludes by highlighting the time-saving benefits of using AI in the penetration testing process, allowing testers to uncover more critical vulnerabilities within the limited time window of a pentest.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
