Re: Bruteforce HTTP Basic authentification

From: Chris Kuethe (chris.kuethe_at_gmail.com)
Date: 08/18/05

  • Next message: Beauford, Jason: "RE: MS05-039 Scanner" 
    Date: Thu, 18 Aug 2005 14:05:49 -0600
To: Serg Belokamen <serg.belokamen@gmail.com>, Pen Test <pen-test@securityfocus.com>

    By optimized alphabet, I mean sort the letters to be tried by order of
    frequency in your probably target language. You could try AAAAAAAA,
    AAAAAAAB, AAAAAAAC, ... but there's a reason why they give you
    "RSTLNE" for free on Wheel of Fortune.

    The last big brute force I did, I took the standard unix dictionaries,
    plus the text of a bunch of ebooks I had on my laptop and came up with
    frequency distributions for the first through fourth letters of the
    average english word. As I was targetting a system where most of the
    users were native english-speakers, I figured this was a safe
    assumption to make. It took some minutes for my frequency counter to
    run, but when I was finished, I had a set of alphabets that made it a
    lot more effective to search for dictionary words, their leetspeak
    variants, and finally alphanumeric keyboard smashing...

    CK

    On 8/17/05, Serg Belokamen <serg.belokamen@gmail.com> wrote:
    > What do you "optimised alphabet" ... any URL's etc?
    >
    > Cheers,
    > Serg
    >
    > On 18/08/05, Chris Kuethe <chris.kuethe@gmail.com> wrote:
    > > On 8/17/05, nik <nik@adminzone.ru> wrote:
    > > > Hello list!
    > > > I'm doing little pen-test of a web-application for a small
    > > > company.
    > > > This application uses HTTP Basic autintification. So the
    > > > question is:
    > > > does any one know some tools (such as brutus) for
    > > > brutforce usernames
    > > > and passwors for this type of authentification. These
    > > > tools must run
    > > > under Linux or FreeBSD.
    > >
    > > The LWP perl module will do quite nicely. Combine that with an
    > > optimized alphabet or 4, and you can have a very effective brute
    > > forcer in a couple of screenfuls of code. Optimizing your alphabet can
    > > be very effective, taking the time to crack a password down from hours
    > > to minutes or even seconds if you have a good idea about the letter
    > > distribution. ;)
    > >
    > > CK
    > >
    > > --
    > > GDB has a 'break' feature; why doesn't it have 'fix' too?
    > >
    > > ------------------------------------------------------------------------------
    > > FREE WHITE PAPER - Wireless LAN Security: What Hackers Know That You Don't
    > >
    > > Learn the hacker's secrets that compromise wireless LANs. Secure your
    > > WLAN by understanding these threats, available hacking tools and proven
    > > countermeasures. Defend your WLAN against man-in-the-Middle attacks and
    > > session hijacking, denial-of-service, rogue access points, identity
    > > thefts and MAC spoofing. Request your complimentary white paper at:
    > >
    > > http://www.securityfocus.com/sponsor/AirDefense_pen-test_050801
    > > -------------------------------------------------------------------------------
    > >
    > >
    > 

    -- 
GDB has a 'break' feature; why doesn't it have 'fix' too?
------------------------------------------------------------------------------
FREE WHITE PAPER - Wireless LAN Security: What Hackers Know That You Don't
Learn the hacker's secrets that compromise wireless LANs. Secure your
WLAN by understanding these threats, available hacking tools and proven
countermeasures. Defend your WLAN against man-in-the-Middle attacks and
session hijacking, denial-of-service, rogue access points, identity
thefts and MAC spoofing. Request your complimentary white paper at:
http://www.securityfocus.com/sponsor/AirDefense_pen-test_050801
-------------------------------------------------------------------------------
  • Next message: Beauford, Jason: "RE: MS05-039 Scanner"

    Relevant Pages

    • Re: Kanji, Katakana, and Hiragana are different LANGUAGES.
      ... that no one has commented "these 'writing systems' are 'pictographic' ... The roman alphabet may memorialize ancient representations of concrete ... memorializing the Phoenician ancient representations of concrete objects. ... the meaning of some of the names of the Hebrew letters is the same ...
      (sci.lang.japan)
    • Re: new book on the spread of IE
      ... systems involve alphabets with multiples of 9 letters -- and the fact ... The Ionic alphabet had 24 letters, ... epigraphy lists them as "the very first Greek alphabet." ... The originals were gold disks worn on the shoulders by ...
      (sci.lang)
    • Re: new book on the spread of IE
      ... systems involve alphabets with multiples of 9 letters -- and the fact ... shows that the Canaanite script was _not_ used as numerals: ... The Ionic alphabet had 24 letters, ... language, and inflict your pro-active ignoring on us. ...
      (sci.lang)
    • Re: Alphabet
      ... the manual and for the alphabet series. ... * Experimentation with rounded letters began almost as soon as the ... draft rounded alphabet series were available and were used ... from Series A to Series F, but not Series E Modified and the lowercase ...
      (misc.transport.road)
    • Re: Looking for a Rather Obscure English Word ...
      ... > successive letter of the alphabet ie: ... constrained writing in which the first letters of consecutive lines ... Eager eye and willing ear, ... Dreaming as the summers die; ...
      (alt.usage.english)