[I|I||I|||III||||I]

Does anyone know what programs I could use to bruteforce my way into this scrubs login page. It does not have any kind of lockout or brute force protection on the login.php. This has to be something very simple... I also don't want any dictionary attacks, that defaces the point. It would also be better if I could start the attacks at say 5 char's long.

[comrade1212]

You can use Fireforce. Its firefox plugin. also there is software in the wild that brute admin page.

[iosif1011]

Brutus would do it.
http://www.hoobie.net/brutus/brutus-download.html

[I|I||I|||III||||I]

Brutus needs a password list and fireforce just does nothing when I try them...

[21redallday12]

use, hydra. Its gets a bit complex with any auth other than "basic-auth" because you have to define a regex or string that occurs on complettion and that kinda thing, with basic auth you just check the respcode eg 401,200 ok

[I|I||I|||III||||I]

use, hydra. Its gets a bit complex with any auth other than "basic-auth" because you have to define a regex or string that occurs on complettion and that kinda thing, with basic auth you just check the respcode eg 401,200 ok

Does hydra not require a password list? I always thought it did.

[21redallday12]

Does hydra not require a password list? I always thought it did.

Oh yeh? i didn't read the thread properly, why on earth would you not want to use a wordlist?

Brute forceing with wordlists is highly recommend and also highly successful.
Don't get me wrong to crack passwords that are under 5 characters might work but even then there's about a 95% chance that the password would of been in a worldlist that would equal less than the bruteforce list size if that makes sense.

I have experience with this, and i tried exactly what your talking about, its no good. It will work with offline attacks eg cracking hashes and what not because you can go through hundreds or even thousands of key per second.

But with online attacks, especially html form attacks, you'l have to send the request to the server, wait for the html response, look for the string eg "logged in" + a proxy if you want to be annonymous which are slow as f*ck, and on top of that no matter how many threads you use, it would still have to timeout now and again, Eg time.sleep(5).

Impossible (if it does work pm me, because i will be intrigued )