/ )( \( __)(_ _)( _ \( _ \
) \/ ( ) _) )( ) / ) /
\____/(__) (__) (__\_)(__\_)
v1.0.4 - Credential Stuffing Tool
What is Credential Stuffing?
Attackers take millions of username/password pairs leaked from other websites and test them automatically against a target site (like a bank), hoping the user reused their password.
Generic Bank
Welcome back, please login.
Account Security
Configure your defense settings
How to Use
Load the Database
Click Load Leak DB in the left panel. This simulates an attacker purchasing a list of stolen emails and passwords.
Start the Attack
Click Run Script. Watch as the "bot" tries different passwords against the bank login on the right.
Defend Yourself!
After seeing the account get hacked, reset the simulation. Then toggle 2FA / MFA ON (bottom right) and run the attack again. See how it blocks the intruder!
Account Compromised!
The attacker found a match. This user used the same password on a gaming forum (which was hacked) and their bank.
How to prevent this?
- Never reuse passwords across sites.
- Use a Password Manager.
- Enable 2FA (Two-Factor Authentication).
Attack Blocked!
The attacker guessed the password, BUT 2-Factor Authentication stopped them.
> Missing OTP Code