You know you really got me going with your post. I've spent the whole day thinking about this and now I've been looking up ways to write a PoC. Because I don't

You know you really got me going with your post. I've spent the whole day thinking about this and now I've been looking up ways to write a PoC. Because I don't think a blog post without a proper PoC will do much good. So first of all assembling a wordlist was easy using Python. The hard part will without a doubt be interacting with one of the entry points to their service. It's a flash application, with a login form. I've discovered Selenium for this purpose, and theoretically Selenium can act as a browser, clicking input fields in the flash form relative to where the element is created on the page. And then I can take a picture of the current page after each operation and compare it to how the page should look at login, or at failed login. Jesus did you just ruin my weekend. ;) (in a good way) Edit: Found sikuli and was amazed by how simple it is. Jython script that let's you essentially use images from your screen as conditional expressions in Jython. So you can do if exists(screenshot of bank login form.jpg): click(screenshot of first input field.jpg) type('bla') And so forth. Very powerful stuff! Sikuli scripts can then be called by external programs such as CPython Popen for example, and passed arguments.