[shahank]

Here's a blog post I wrote that describes an approach one can follow to crack a user login form with a dictionary attack.


hecktheplanet .wordpress. com/2022/09/25/0x02-et-tu-bruteforce/

[73SLA]

Actually didn't work SO

SO

...u need to change your method .

Bruteforce is just 95% lobby and 5% real .

[shahank]

Actually didn't work SO

SO

...u need to change your method .

Bruteforce is just 95% lobby and 5% real .

Did you try giving a suitable path to the wordlist? Since that would be according to the attacker's preference.

Other than that, I've checked and there should be no reason for it not to work.

[skags]

I would totally agree with the above. Most of the time- doesnt work.

[shahank]

I would totally agree with the above. Most of the time- doesnt work.

Yes of course.

I even take up that point in the post at the end.

At the end of the day, the program is just a glorified proof-of-concept and literally any other method to bypass logins is a better way than bruteforcing the password.

[Goku]

I haven't visited your blog.

But, since I make websites for customers. Does Google Recaptcha help against your bruteforce? I would guess yes.

[SuperiorUser]

I haven't visited your blog.

But, since I make websites for customers. Does Google Recaptcha help against your bruteforce? I would guess yes.

if implemented correctly it can slow an attack down enough to not be cost viable to use dictionary attacks.

[shahank]

I haven't visited your blog.

But, since I make websites for customers. Does Google Recaptcha help against your bruteforce? I would guess yes.

Totally does.

As much as I would like to think that there are some fancy ways of bypassing ReCaptchas on login pages, there isn't really that much an attacker can do apart from bruteforcing the ReCaptchas themselves (which is completely insane), or finding some fault in the ReCaptcha itself (faulty RNG?) and exploiting that.

[Goku]

if implemented correctly it can slow an attack down enough to not be cost viable to use dictionary attacks.

Totally does.

As much as I would like to think that there are some fancy ways of bypassing ReCaptchas on login pages, there isn't really that much an attacker can do apart from bruteforcing the ReCaptchas themselves (which is completely insane), or finding some fault in the ReCaptcha itself (faulty RNG?) and exploiting that.

Thanks for the feedback guys!

[johngacy]

Hopefully AI will outpace those pesky captchas (in my Masters I wrote an article with source code on cracking 2000s-style captchas).

Anyway awesome article!

[shahank]

Hopefully AI will outpace those pesky captchas (in my Masters I wrote an article with source code on cracking 2000s-style captchas).

Anyway awesome article!

Much appreciated!

And wow that article you mentioned sounds totally interesting.

[bl4ckc0d3]

Not sure why the article says "bypassing http logins" a dictionary attack is basically trying a bunch of passwords or usernames until it matches the right one, which is cracking. Bypassing the login page usually means you found a method to bypass the login page without entering any usernames or passwords.

[SIM-5255902]

is there any way to bypass re/captcha in logins pages ?

[bl4ckc0d3]

is there any way to bypass re/captcha in logins pages ?

i've seen a few cases where the captcha is easy to guess or using the same recaptcha works.

[SIM-5255902]

Tensorflow also can bypass easy one like numbers ...