⚠ FOR SECURITY TESTING PURPOSES ONLY — DO NOT DEPLOY IN PRODUCTION
Basic Auth
HTTP Basic Authentication
HTTP Basic Auth sends credentials as Base64(username:password) in the Authorization header. No encryption, no rate limiting, verbose error messages leak valid usernames.
> Show hints
- [1] Authorization: Basic base64('admin:admin') — try weak defaults
- [2] Verbose errors distinguish 'username not found' vs 'wrong password' — enumerate users
- [3] Base64 is encoding, not encryption — decode any captured header instantly
- [4] No lockout: brute force the password list against a known username
[1] Manual Basic Auth Request
Credentials are Base64-encoded and sent as Authorization: Basic <token>. No HTTPS required by the server.
[2] Username Enumeration
Verbose error messages differ for unknown vs wrong-password. Probe a wordlist to find valid usernames.
[3] Password Brute Force
No rate limiting or lockout. Dictionary attack against a target username.
[4] Base64 Decoder
Paste a captured Authorization header or raw Base64 token to reveal plaintext credentials.