ZeroTrace HID
BRUTEFORCE Primitive
Hardware-rate credential brute-forcing via HID
The bruteForce primitive types candidate strings at HID speed against whatever input field currently has focus on the target. It runs entirely as keyboard output — no network traffic is generated.
Syntax
bruteForce <range> <delayMs> <newLine> <useUsername> <username> <useJitterDelay> <useCharSet> <charSet>
| # | Parameter | Type | Meaning |
|---|---|---|---|
| 1 | range | int (1–8) | Length of each candidate string |
| 2 | delayMs | int | Base delay between attempts, in milliseconds |
| 3 | newLine | bool | Press Enter after each attempt |
| 4 | useUsername | bool | Type a username before each attempt (for user+pass fields) |
| 5 | username | string | Username to type; pass "" when useUsername is false |
| 6 | useJitterDelay | bool | Randomize the delay to look less mechanical |
| 7 | useCharSet | bool | Use a custom character set instead of digits |
| 8 | charSet | string | The custom character set; pass "" when useCharSet is false |
Examples
# 4-digit numeric PIN, 100 ms between attempts, Enter after each
bruteForce 4 100 true false "" false false ""
# 3-char attempts from a custom alphabet, with a username and jittered delay
bruteForce 3 200 true true "admin" true true "abc123"
When useCharSet is false, attempts are sequential zero-padded numbers (0000, 0001, 0002, …) — a true ordered sweep of the numeric space. When useCharSet is true, each attempt is a random pick of range characters from charSet; it is not an exhaustive, de-duplicated enumeration.
Limits
rangemust be 1–8. Any other length is rejected and the command does nothing.- The keyspace is capped at 1,000,000 combinations. If the space (
charSet.length ^ range, or10 ^ rangein numeric mode) exceeds one million, the command returns immediately without typing. Keep the length and alphabet small — this is for short PINs and codes, not large password spaces. - Throughput is bounded by the host, not the device. The target's field-acceptance rate and any lockout policy set the real ceiling;
delayMsanduseJitterDelaypace around them.
This primitive exists for authorized credential testing. The device cannot tell whether your authorization covers the target — the operator carries that responsibility. Every attempt is a keyboard event the host can log. See Limitations for detection and lockout considerations.