brute hack for web credentials