GUI exe BruteForce login test

Question

Hi I have created a login page Below. I want to test the security of my exe I do not want to use a captcha or timeout on my exe.

Are there any applications specifically designed for bruteforcing .exe applications? In my experience I have only encountered web page attacking apps.

That's cool I can use them to test my applications web side.. and i'm happy with the results however, I want to know if there is any kind of bruteforce program I can use which would somehow lock on to the fields of my application and start iterating through usernames passwords etc. Is this possible or am I worrying to much?

CURRENT STATE OF EXE:

notice I am using 3 fields USER, PASSWORD and IP. Data is saved if the client chooses to do so. Written in Delphi/Lazarus (don't hate)

Answer 1

bruteforcing .exe applications

You mean fuzzers? Password list crackers? Program flow analyzers?

Yes. There are. And unless you build in proper (NOT self-rolled) cryptography, you need none of them: a simple debugger, which exists for all operating systems and is an absolute standard tool, can be used to extract the checks you're doing on the input, and just "bend" program flow so that the program just ignores what you enter and does what it would do when you enter the right passwords.

Seriously. Your exe isn't in your control. The only way to disable access to someone who isn't in possession of a secret is to encrypt whatever you want to protect with exactly that secret (either directly, or by encrypting a key with that secret), or to not store the protected thing with the exe but only deliver it from your server, which you do control.

In essence, you must never assume your executable code on someone else's computer is behaving like you've programmed it. Doesn't matter whether it's HTML+JavaScript, Delphi, C++ or assembler. It's running on a machine that you do not control.