Oracle APEX Brute Forcer 🚀

⚠️ Disclaimer This tool is designed for educational purposes and authorized penetration testing only.

Unauthorized use of this tool to attack systems without permission is illegal and prosecutable.

The author assumes no responsibility for misuse of this tool.

A penetration testing tool for brute forcing Oracle APEX authentication systems

---

📸 Screenshot

✨ Features

• 🔐 Brute Force on Oracle APEX Login
• 🔄 Automatic IP Rotation with X-Forwarded-For and X-Real-IP headers
• 🌐 Proxy Support (HTTP/HTTPS/SOCKS)
• 🎯 Success Detection based on Status Code or Regex
• ⏱️ Configurable Delay between requests
• 🎨 Beautiful Color Output with Iran flag colors
• 📝 Save Results to success.txt file
• 🔄 Attack Mode: Fixed password, rotating usernames
• 🛡️ Disable SSL Verification (for internal testing)

📋 Requirements

pip install -r requirements.txt

requirements.txt

requests==2.31.0
beautifulsoup4==4.12.2
colorama==0.4.6
urllib3==2.0.7

🚀 Installation

# Clone repository
git clone https://github.com/omidsec/oab
cd apex-bruteforcer

# Install dependencies
pip install -r requirements.txt

📖 Usage

Syntax

python apex-bruteforcer.py -u <URL> --userfile <USERS> --passfile <PASSWORDS> -s <SUCCESS_CONDITION> [OPTIONS]

Parameters

Parameter              	Description	                                          Required	    Example
-u, --url	        |    Login page URL	                                    |    ✅	   |   https://example.com/ords/r/app/login
--userfile	        |    File containing usernames (one per line)	        |    ✅	   |   users.txt
--passfile	        |    File containing passwords (one per line)	        |    ✅	   |   passwords.txt
-s, --successful	|    Success condition (Status Code or Regex)	        |    ✅	   |   302 or "home"
--proxy	            |    Proxy server	                                    |    ❌	   |   http://127.0.0.1:8080
-d, --delay	        |    Delay between requests (seconds)	                |    ❌	   |   1
--hip	            |    Header for IP Spoofing	                            |    ❌	   |   X-Forwarded-For
--ipfile	        |    File containing IP addresses (one per line)	    |    ❌	   |   ips.txt
--verify	        |    Enable SSL Verification	                        |    ❌	   |   -

Example Commands

1. Basic Usage

python apex-bruteforcer.py -u "https://example.com//university/class/login" --userfile users.txt --passfile passlist.txt -s "home"

With Proxy

python apex-bruteforcer.py -u "https://example.com/university/class/login" --userfile users.txt --passfile passlist.txt -s "home" --proxy http://127.0.0.1:8080

With IP Spoofing (X-Forwarded-For)

python apex-bruteforcer.py -u "https://example.com/university/class/login" --userfile users.txt --passfile passlist.txt -s "home" --proxy http://127.0.0.1:8080 --hip "X-Forwarded-For" --ipfile ips.txt -d 1

With IP Spoofing (X-Real-IP)

python apex-bruteforcer.py -u "https://example.com/university/class/login" --userfile users.txt --passfile passlist.txt -s "home" --proxy http://127.0.0.1:8080 --hip "X-Real-IP" --ipfile ips.txt -d 1

🎯 Success Conditions

By Status Code

-s "302"    # Redirect
-s "200"    # OK
-s "403"    # Forbidden

By Text

-s "home"           # Contains "home"
-s "dashboard"      # Contains "dashboard"
-s "Welcome"        # Contains "Welcome"

By Regex

-s "r'user.*found'"     # Regex pattern
-s "r'کاربر.*موفق'"      # Persian regex