tactifail / sprayandpray Goto Github PK

If HTTPS is in use during a HTTP check (or vice-versa) the script will try the other, but if both protocols are specified to be used then both will be checked. This leads to extra work, and cluttered output.

Script usefulness and speed could be increased by checking if a port is even open before attempting a login. Currently there is no distinction between a failed login due to bad credentials versus a closed port.

Currently a HTTP/S check will succeed if the server does not prompt for basic auth, leading to false positives in the credentials. Script needs to check if basic auth is even being prompted and continue accordingly.