Built a Python framework to automate authentication testing for JavaScript-based Dahua DVR logins. Looking for feedback

[u/uknown67789]

Hi everyone,

I'm a 15-year-old student from Morocco who's been learning Python and cybersecurity over the past year.

While experimenting in an authorized environment, I discovered that traditional tools such as Hydra couldn't interact with a Dahua DVR's JavaScript-based login page. Instead of giving up, I decided to build my own Python framework using Selenium to automate browser-driven authentication testing.

The project is called RedaForce.

GitHub: https://github\[.\]com/REDA-MAH/RedaForce

I'm not posting this to ask for stars. I'd genuinely appreciate technical feedback on:

Code quality and project structure

README and documentation

Python best practices

Repository organization

Features you think would make the project more useful

I'm still learning, so I'm especially interested in constructive criticism from more experienced developers.

Thanks for taking the time to look!

[u/caramel_mutt]

You have a good starting point, I would advise on having a watchdog feature to observe if the DVR is on. When the user tries to log on if it's not active they don't get access. But a on screen notification for that.

Password attempt limits for brute force attacks, set a limit to 20. I also see the opportunity to make this into more, if you start to think about the data flow of it you can build more on top

[u/uknown67789 → u/caramel_mutt]

Coul you please explain the 20 limit part more

[u/caramel_mutt → u/uknown67789]

So you can program a maximum of tries to access a site using a "For" loop combined with a "try-except" block for requests library. Track the loop count then catch the connect errors, and use "break" to stop it when/if connection works.

Something like this: range(1, max_tries + 1) for the loop

and this "requests.get(url)" sends the request to the target.

And this time.sleep(2) adds to the cycle a quality so there isn't a server overload.

Then simple conditional for the ending of the loop with an "Else"

Edit: don't forget a 404 request timeout message at the end of the 20 tries. Also include a IP block after recurring attempts form the same IP address. On the 3 try advice the user to reset password...20 tries is generous, 5 is more than enough.

Ok 5 tries, lock account, send email notification to the user saying account locked please reset password. If after the 5 attempts it reaches 10 block the IP address. Doesn't matter how many times this happens, if you create an API to manage backend requests you take the stress out of the server being requested.

[u/uknown67789 → u/caramel_mutt]

I'm still soooo confused what are 20 or 5 tries for, just to clarify first did u read the README.md in my repo? Cuz this tool is supposed to automate the entering of probable passwords from a wordlist generally to find the right password

[u/caramel_mutt → u/uknown67789]

Ok, so I am showing you that your project is part of a bigger project.

Looks at it this way: very nice project but doesn't show applications of use. If you added it to a context makes it easier to showcase.

Add your project as a filter for a login screen project with a security feature. Then you can perfect it's data flow understanding how it works out as part of a bigger process.

Does that make more sense? Sorry I might have misunderstood that you wanted to showcase it in a different reframe.

"Features that you think you make the project more useful" is what lead my answer.

[u/uknown67789 → u/caramel_mutt]

Thank you so much for this feedback and I will provide showcase gifs and screen shots of it's work flow as soon as possible Appreciate the acknowledgement