Authentication Attempt Exhaustion in Fortinet FortiMail Login Form

Repository contains a small Python proof-of-concept labeled CVE-2022-29056 with a Tkinter GUI front-end. Structure: - README.md: Portuguese description stating it is an educational automation script to send repeated requests to a login endpoint and vary payload size. - exploit.py: Main script. Provides a GUI to input a target IPv4 address and a payload size, validates the IP via regex, then starts a background thread that repeatedly POSTs to https://<target_ip>/logincheck every 2 seconds until stopped. Exploit capabilities: - Network-based request automation against a specific login path (/logincheck). - Generates oversized form fields (username and password) of operator-chosen length; username is prefixed with a single quote and suffixed with '#', which resembles basic injection/probing patterns. - Prints HTTP status code and full response body for each request. Notable implementation details/limitations: - TLS verification is disabled (verify=False). - Uses a hardcoded csrfmiddlewaretoken value, which may not be valid for real sessions and could limit effectiveness unless the target accepts it. - No vulnerability verification logic beyond observing responses; no RCE, shell, or privilege escalation payloads included.