🔐 Python Flask Brute-Force Authentication Lab

📖 Project Overview

This project demonstrates a controlled authentication testing lab built with Python and Flask. A local web application simulates a login page, while a separate Python script automates login attempts using username and password wordlists.

The objective is to demonstrate how repeated login attempts can identify weak credentials in a controlled environment and to reinforce defensive security concepts such as strong passwords, account lockout, and rate limiting.

---

🎯 Objectives

• Build a local Flask authentication system
• Develop an automated authentication testing script
• Understand HTTP POST requests
• Demonstrate password guessing using wordlists
• Practice Python scripting
• Learn secure authentication concepts

---

🛠 Technologies Used

• Python 3.13
• Flask
• Requests
• Virtual Environments (venv)
• Visual Studio Code
• Git
• GitHub

---

📂 Project Structure

python-flask-bruteforce-lab/
│
├── Screenshots/
├── attack.py
├── flaskapp.py
├── usernames.txt
├── testpwlist.txt
├── requirements.txt
├── .gitignore
└── README.md

---

🚀 Running the Lab

Clone the repository

git clone https://github.com/melusisello/python-flask-bruteforce-lab.git

Create a virtual environment

python -m venv venv

Activate it

Windows

.\venv\Scripts\Activate.ps1

Install dependencies

pip install -r requirements.txt

Run the Flask application

python flaskapp.py

Open:

http://localhost:34224

Run the authentication testing script

Open a second terminal:

python attack.py

---

📷 Screenshots

Login Page

Successful Login

Flask Server

Authentication Testing

---

📚 Skills Demonstrated

• Python Programming
• Flask Web Development
• HTTP POST Requests
• Authentication Testing
• Wordlist Automation
• Python Virtual Environments
• Git & GitHub
• Technical Documentation

---

⚠️ Security Notice

This project was developed and executed entirely within a local, controlled environment for educational purposes. It demonstrates authentication testing concepts against a self-hosted application to better understand password security and defensive best practices. It is not intended for use against systems without explicit authorization.