Reply to thread

Message: <blockquote data-quote="FUNasela" data-source="post: 3963407" data-attributes="member: 54899">********** is a multifeature Web password cracker. The program is written for ****** only but allows for a number of different types of authentication **** forcing, including:·         HTTP (Basic Authentication)·         HTTP (HTML Form/CGI)·         POP3 (Post Office Protocol v3)·         FTP (File Transfer Protocol)·         SMB (Server Message Block)·         TelnetAlthough HTTP Basic is the most ubiquitous program on the Internet today, HTTP Form is close behind. To use ***** to ***** force a standard HTTP Basic page, we need only input the target in the Target field, select HTTP (Basic Authentication) in the Type field, and then select the type of Authentication Options (by default it will use the most common of usernames and passwords). Figure 15-5 shows how ***** can be set up to brute force known usernames and passwords.Figure 15-5. **** ****** forcing an HTTP Basic connectionThe Positive Authentication Results window shows that the administrator username and test username have been confirmed to have a blank password and the word "test," respectively.However, if we have exhausted our list of usernames and passwords, we can allow **** to identify the password with its brute-force options. As shown in Figure 15-6, with these options we can select the size and composition of the password in an attempt to include the full ASCII keyspace or a customized range.Figure 15-6. ****'s *****-force password optionsThen when **** runs, which could take some time, it will attempt all the permutations of the set created. Figure 15-7 reveals that, with 0–6 length and lowercase alpha as the composition, the complete brute force will take about a month on a P4-1.2 GHz machine. Not quite the speed we were looking for, but the feature is robust.Figure 15-7. ***, using the true ****-**** featureBut the real advantage of using *** for Web password cracking is for HTTP (Form) attempts. **** offers a number of features that accommodate whatever form we have, including the support of cookies and user-defined responses. Figure 15-8, shows ****'s simple interface for setting up an HTTP (Form) brute-force attempt.Figure 15-8. **** and HTTP (form) settingsNow, using the "Learn From Settings" button, we let Brutus try to read the form we want to brute force and understand what it requires for authentication. Figure 15-9 shows the returned options and fields specific for the targeted form.Figure 15-9. **** Form ViewerThe two fields in the form are "user" and "password." The back-end server program that processes the user and password to validate it is /cgi-bin/login.cgi. We accept these parameters and have ***** attempt passwords against the system, as shown in Figure 15-10.Figure 15-10. **** and HTTP (form) results****'s flexibility is robust and its feature set unrivaled. It will perform every major authentication attempt except NTLM. The only program we know that offers NTLM **** forcing is ****</blockquote>

Verification: Dawasata paya keeyak thibeda?

Top Bottom