Re: Optimal wildcard search algorithm

Hello Tim,

Do I understand correctly, that the wildcard test you describe only
gives an exists/doesn't exist answer? How many tests can you afford
per second?

One approach to finding all usernames would be a kind of breadth-first
search based on the character set and character position. Given a
character set of [a-z0-9], we could try the following:

a*
b*
c*
...

and determine which characters exist in the first position. From there,
each second letter would be tried for each successfully identified first
letter, and so on.

What you can try is to analyse some sample username lists for
ways to equalise their distribution. For example, you wouldn't want to
start with a*, better jump directly to aa*, ab*, ..., az*

You might try taking samples from
http://www.galbithink.org/names/agnames.htm
http://blogs.parc.com/playon/archives/2006/06/naming_patterns.html
or similar, some username/password combo lists, etc.

You can also test for suffixes (*a, *b, ..) hoping for a better
distribution.

Let us assume for now that the only wildcard character is the '*' or '%'
kind (and not the single-character kind), and that the string we're
searching for could be of any length.

If you're allowed single-char wildcards, you could do more interesting
searches - tests for certain username lengths being the most
important. You can also walk the search space based on the *second*
letter of the username _a%, _b% etc, which will (I guess) be more
equally distributed than the first letter.

I don't know if searching for substrings in the middle hoping they
would prune the search tree will be helpful - but you can analyze
those sample lists and see if particular patterns come up. If there is
a good set of 2 or 3 character strings that have near-zero frequencies
in the sample lists, that's the way to go.

Mordred


------------------------------------------------------------------------
This List Sponsored by: Cenzic

Need to secure your web apps?
Cenzic Hailstorm finds vulnerabilities fast.
Click the link to buy it, try it or download Hailstorm for FREE.
http://www.cenzic.com/products_services/download_hailstorm.php?camp=701600000008bOW
------------------------------------------------------------------------

Relevant Pages

  • Re: Optimal wildcard search algorithm
    ... Then, for the second round, aa*, ab* ... after the two rounds of bruteforcing, ... error for a wildcarded username that does exist but can't be bound to, ... > or similar, some username/password combo lists, etc. ...
    (Pen-Test)
  • Re: Blank Emails
    ... Phonebook or dictionary attack on the mail server. ... number ) to get current lists of valid usernames. ... If the username is rejected, ... The list may then be sold to other spammers. ...
    (alt.computer.security)
  • Re: Penetration test of 1 IP address
    ... I have been asked to perform a security audit of 1 IP address for client. ... don't have any username to start, you must use a list of common ... So you need to use a very small password lists (really ... Up to 75% of cyber attacks are launched on shopping carts, forms, login pages, dynamic content etc. Firewalls, SSL and locked-down servers are futile against web application hacking. ...
    (Pen-Test)
  • Re: Exchange 2003 w/ Outlook 2003
    ... >> problem when you're connecting to Outlook 2003. ... > The username is in the context of joeblow@suffix.com. ... Let me expand on the Recip. ... lists so that only users in ...
    (microsoft.public.exchange.admin)