اعلان

Website

المدونة

ملاحظات يجب قراءتها:

1. نتبرئ من استخدام أي موضوع في المدونة في طريق الحرام أو ضد المسلمين.
2. إن لم تجد الموضوع الذي بحثت عنه في محرك البحث، استخدم البحث الداخلي في المدونة.
3. هناك مراكز رفع ملفات تحتاج الى استعمال بروكسي للتحميل المجاني دون عمل حساب مدفوع مثل مركز رفع uploading.com
4. نعتذر عن عدم توفر بدائل لبعض الروابط المفقودة
5. الرجاء فحص الملفات جيداً قبل التشغيل فيما يخص أدوات الهاكرز و الفيديو..الخ
6. ليست كل البرامج كاملة و ليست كل البرامج تحتاج الى تسجيل!!؟؟
7. عزيزي الزائر تشرفنا بزيارتك، و أعلم أنك لست أول زائر و لن تكون الاخير بإذن الله تعالى، تمتع بتصفح المدونة دون مشاكل بإذن الله...
8. لا تنس استخدام (رسائل اقدم) لرؤية باقي مواضيع التصنيفات

انشاء المدونة

تم انشاء المدونة في:

07\01\2009

Black ice

كل عام و أنتم بألف خير بمناسبة مرور 4 سنوات على انشاء المدونة و الحمدلله

ĬŖŞĤ@ĮĐ مدونة الخدع و الشروحات إرشيد الجرايدة ĬŖŞĤ@ĮĐ

How to Crack a Porn Site Step by Step

The Porn Cracker's Tool Shed "How To Crack A Porn Site" Tutorial
Tutorial written by 'on_a_role_again' as part of The Porn Cracker's
Tool Shed. HTML tutorial wrote by WinblowZ (Immortal Productions)

- Our Disclaimer

- Introduction

- The Method (Brute Force)

- What you will need

- Preparing The Work Space and Installing The Tools
Installing ProxyRama
Getting Familiar with the workspace

- Proxies
Testing proxies with Charon
Finding proxies with ProxyRama
Using proxies to browse the internet with Internet Explorer

- Finding targets

- Making combolists
Making a combolist using VLStrip

- The attack
Preparing Sentry

- Miscellaneous
Our contact information
Links to related sites


--------------------------------------------------------------------------------

Disclaimer

This is for informational purposes only and should only be used for
such. Neither the author nor the distributors take any
responsibilities for how one might use this information. Do not use
this information for any illegal activity. Be smart, have fun.

In Addition

This distrobution has been put together without the consent of any of
the creators of Athena (Rhino), Charon (Rhino), Proxyrama (GaaMoa), or
Sentry (Sentinal) all of whom can be found at securibox.net. You
should always be considerate and greatful to the creators of these
tools, please show them any support that you can. Offical help for
these tools may also be obtained at securibox.net from there creators.


--------------------------------------------------------------------------------


Introduction

This How To will teach someone who knows nothing at all about cracking
websites how to gain access to a website that requires membership. The
method discussed here is known as brute forcing. The idea behind brute
forcing is that the usernames and passwords that people use on many
sites are easy to guess. This is for the most part true and you will
see very soon that many people have successfully cracked websites by
systematically guessing usernames and passwords. This document will
give clear (i hope) step by step instructions on how to brute force
(bf) your first site knowing next to nothing about cracking. All the
tools and documentation that you need are included in the "The Porn
Crackers Tool Shed." Which this document originally came in however
most of the programs used can be found by doing a simple google search
or asking around at Securibox.net.


--------------------------------------------------------------------------------


The Method (Brute Force)

When you become a member of a member site you are often given the
chance to choose a username and password. Sometimes there are some
restrictions on these, but often times they are weak, for instance
usernames must be between 6-8 characters. Most people use common words
like, (superman, fastcar, jaguar, etc..) to make up there username and
password. A username/password pair is known as a combo and is often
written in this format... USERNAME:PASSWORD, do to the http standard,
which says that you can authenticate by using the string
http://USERNAME:PASSWORD@members.membersite.com. A quick google search
will come up with many, many, such strings, try googling :

google : 'http://*:*@members.*.com'

We wish create a list of combos and try them against the site that we
wish to crack (the target). These are known as combo lists and will
look something like

gin:vodka
dallas:cowboys
really:badass
myname123assword
etc...

We could in principle go to the target website and try each on of
these buy hand, but there are few problems with that. First its a lot
of work and no one wants to do that. Secondly, there is a good chance
that program which checks to see if the combo is correct will have a
limit on how many times the same computer (really the same IP address)
can try to gain access. Thirdly, if you get in chances are the
webmaster will realize that you have broken into the site and will at
least suspend the combo so that it doesn't work anymore and possibly
file a complaint against you. For the first problem there is a tool
that comes with the The Porn Crackers Tool Shed, that will help reduce
the amount of work you have to do in checking your combo against a
target to a few clicks. This program is known Sentry written by
Sentinel of Securibox.net. Solving the last two problems can both be
done by using anonymous proxy servers. What are anonymous proxies? In
short, proxies are computers which act as a middle man between your
computer and the site that you are trying to view. Anonymous proxies
are proxies which don't tell the computer that you are communicating
with who/where you are. So the ascii picture would be like this

With out proxy
your pc -----------------------> website

With Proxy
your pc ------> anon proxy ----------------> website

You can remain anonymous (in all fairness you remain difficult to
track as apposed to the very strong term anonymous) to the websites
that you are viewing by using an anonymous proxy, this is a must. So
where do you get these anonymous proxies and what do they look like?
Well just like combo lists, people post proxy lists on websites and
message boards. A proxy server is a computer on the internet that has
an ip address just like any other computer (if you don't know what an
IP address is try googling 'ip address,' in short, its how computers
know where each other are; just like a street address). The IP address
will look something like ###.###.###.###:PORT where ### stands for a
number between 0 and 255 and PORT stands for a number between
1-8080. A proxy list will look something like

123.123.13.13:80
124.232.0.1:80
211.123.0.2:80
etc...

So where do I find proxy lists and combolists? Well as for proxylists
you can try message boards, googling "anonymous proxy list" or
something similar or you can use the Proxyrama tool written by gaamoa
of Securibox which comes with The Porn Crackers Tool Shed. You can
look for proxies by searching a range of ip addresses, but this is not
covered in this HowTo. Once you have found a proxy list you have to
check it to see which proxies are still working, for this there is the
tool Charon written by Rhino of Securibox. As for combolists you can
find them by googling or on message boards. However, really you should
make your own combolists as it is very hard to find a good combolist
posted; because they are difficult to make and work best if you don't
share them. The Porn Cracker's Tool Shed comes with the tool VLStrip
on_a_role_again of Securibox (me) which uses the nifty google strings
like the one I gave above 'http://*:*@members.*.com' and a little
cutting and pasting to make quite effective combolists. New to this
version of TPCTS we use the very simple tool Athena written by Rhino
of Securibox to help make combolists.


--------------------------------------------------------------------------------


What you will need
1. A Windows OS

2. A Modem Connection (faster is better)

3. A Web browser (I will Assume IE 6, or mozilla)

4. The Porn Crackers Tool Shed, INCLUDING:
4a. Sentry - Sentry.exe
4b. Charon - Charon.exe
4c. ProxyRama - ProxyramaSetup.exe
4d. VLStrip - VLStrip.exe
4e. Athena - Athena.exe


--------------------------------------------------------------------------------


Preparing The Work Space and Installing The Tools

We are going to create a work space environment in the Folder Called
'Workspace' This will be your "Desktop" for cracking. You should be
able to open this folder and easily get at all the tools that you will
need.


INSTALLING PROXYRAMA
1. Open up the folder ProxyRama

2. Click on ProxyramaSetup.exe

3. A pop up window will appear with a description of the tool, don't
worry if you don't know what proxies are. Click Next

4. If you agree to the SOFTWARE LICENSE AGREEMENT then check "I
agree..." and Click Next.

5. Choose default location for install or anywhere else you would like
just make sure to take note of where you installed it, most
commonly this will be C:\Program Files\Proxyrama. Click Start

6. Click OK.

7. You may wish to create a start menu folder if so leave the box
checked otherwise uncheck

8. The info that is presented maybe useful later on but for now you
may ignore it. Click OK

9. A folder with a shortcut to the Proxyrama and an uninstall feature
should pop up copy proxyrama shortcut to the Workspace folder

10. Also create a shortcut from your Proxies\Work Folder to the folder
that you installed proxyrama to.

GETTING FAMILIAR WITH THE WORKSPACE

By now when you open up the Workspace folder you should see 3 folders.

Workspace Structure
+ ComboLists - Where you will make and save your combolists.
- GrabbedLists - Where you save combolists you find off the internet.
- MyCreations - Where you will save combolists you make.
- ValidLoginsTexts - Where you will keep copies of valid login texts.
+ Work - where you will make combolists.
- VLStrip - where the VLStrip.exe is stored.
- Athena - where Athena.exe is stored.
+ Proxies - Where you will make and save your proxylists.
- Charon - Where the Charon.exe tool is stored.
- CheckedProxies - Proxy Lists that you have checked.
- ProxyWebsites - Links to websites that have proxylists.
- UncheckedProxies - Where you will store your unchecked proxy lists.
- Work - Where you will make proxylists.
- Sentry - Contains Sentry.exe etc.
- A shortcut to Proxyrama


--------------------------------------------------------------------------------


Proxies

Finding proxies is a bit of an art if you don't have a good message
board, or irc channel that you can trust to download from. A very good
message board which specializes in proxylists is proxyblind.org. You
may wish to become a participating member of this board as it will
make finding and sharing proxies much easier. Though if you don't wish
to join this or any other similar board, all is not lost. You can try
some simple google searches to find proxy lists to check. The
following searches strings are suggestions and you should try some of
your own.

anon proxy
anonymous proxies
proxies.txt
proxy list
anonymous proxylist
"index of" proxy list
"index of" *proxies*txt

Once you have a proxy list, cut and paste the contents to a text
file. Lets say you call the proxy list file prxy.txt. Try to find a
proxy list with 500+ entries, or cut and paste a bunch of smaller ones
together until you have a big enough list. You should store the
proxies you find in a test file. Save prxy.txt to the folder
(~\Workspace\Proxies\UncheckedProxies). Once you have done that it is
time to fire up Charon. NOTE: in many proxy lists there are other
things noted on the same line as the proxy's IP address you can for
the most part cut and paste the whole line the proxy address is on and
Charon will be able to sort it out. Charon's not to picky.

Testing proxies with Charon

1. Charon.exe is located in (~\Workspace\Proxies\Charon), find it and
open it.

2. "Right Click" in the white grid space of the Charon window Then
choose "Load Proxies"-->"Import From File."

3. Choose the file you just created 'prxy.txt', the proxies should now
be loading.

4. "Right Click"-->"Mark for Test"-->"Check all for test"

5. We now want to check the proxies so click "Check Proxies" under
controls in the bottom right corner of the window. If a error
window comes up which says can't determine ip address click "Yes"
for auto detect. This should start the checking process.

6. When Charon has completed, "Right Click"-->Delete-->"All apart
from..."

7. Now you have a list of anonymous proxies, create a file in
(~\Workspace\Proxies\CheckedProxies) called TODAYSDATE_prxy.txt

8. In Charon "Right Click"-->"Copy to Clipboard"-->"Copy All IP:PORT"

9. Open up TODYSDATE_prxy.txt and Paste from the clip board. you
should now have a proxy list.

Hopefully this will result in a list of about 100 proxies (more is
better), you need a bunch, but how many depends on the size of your
combolist and who you ask. Again having a good forum to share and find
proxies from can make this step very quick and painless. Having to
google alot and cut and paste can get to be a pain. For this reason
their is Proxyrama. Proxyrama will search the web for proxy lists,
download the results and test them all with a few clicks. This is a
great program to click just before you go to bed; when you wake up you
will have a nice proxy list to post to your favorite board, or use for
your own little projects.

Finding Proxies with Proxyrama

1. Open up Proxyrama

2. Choose Settings -> Internal proxy judge, if this doesn't work (i.e
port 80 is in use) you can try the external judge. In which case
you may have to find one yourself; try googling "prxjdg.cgi" or see
the link at the bottom of this document.


3. Click Options -> Show. Choose speed. 12-20 depending on connection speed

4. Click Options -> Show. Choose retry 0-3 depending on how patient you are.

5. Click Options -> Show. Choose Timeout 1-10, the lower the number
the fewer proxies you will get, but it will only keep the fastest
ones. 5 is a good starting place.

6. Click Search

7. Wait for 10+ min, longer is better. You are now finding and
checking a large list of online proxy lists found via google.

8. Once you think you have a good enough list Click Abort, Proxyrama
will continue to test the last of the proxies. This can take
another minute or two. If you don't want to wait you can press the
white abort button that becomes highlighted.

9. Click "Delete not working"

10. Click "Delete not anon"

11. Click "Delete Dangerous"

12. Click export, save the file as TODAYSDATE_prx.txt, in the folder
(~\Workspace\Proxies\CheckedProxies).

Now lets look inside the proxyrama folder. Open up the folder where
you installed proxyrama, this is most likely C:\Program
Files\Proxyrama (you should make a shortcut), in this folder you will
find a few files of interest. The pvisted.txt file contains the list
of webpages where proxyrama has found proxies. I like to delete the
contents of this file every few days as these pages will not be
visited by proxyrama again, yet these pages may very well get updated
on a daily or weekly basis so it is good to check them again. Also you
will see a bunch of files with names like backup_DATE_prx.ini if
proxyrama ever crashes these files contain information that proxyrama
needs to recover from a crash so that you don't lose all the proxies
that you have found. These files might start showing up in the folder
that you export. You should delete these files every so often as they
will cluter up things. If you are paranoid you can check the proxylist
you make with proxyrama again with Charon. Perhaps not a bad idea.

Using Anonymous Proxies to Browse The Net In IE6

It doesn't hurt to use a reliable, fast, anonymous proxy when you are
looking for sites to crack and it is mandatory when you have gained
access and now wish to browse the site that you have cracked. In fact
when you are browsing the site after finding a valid login you should
use the same exact proxy that Sentry used to gain access. You may wish
to run a `whois' on your proxy to see that it seems like a safe place to
surf from, avoid proxies that are from government (.gov), military
(.mil), or education (.edu) domains. You can do this from
DNSstuff: On-demand DNS and network tools to analyze, diagnose and monitor a domain or IP address. The following are directions on how to use a
proxy in IE6 but if you have another browser the instructions are very
similar and you can check the homepage of your browser to find them or
try googling "(MyBrowsersName) configure proxy."

1. Open the browser

2. Click Tools-->Internet Options-->Tab Connections

3. Now if you use a Hi Speed LAN Click "LAN Settings" or else choose
"Settings"

4. Click on "use a proxy"

5. in the address field put in the address i.e. 123.123.123.123 in the
port section in the port number i.e. 80 this would be from standard
proxy list format 123.123.123.123:80.

6. Now go to a page such as privacy.net, or whatsmyip.com and see that
that they display the ip address of the proxy you use and not your
real address (which can be found by running winipcfg).

NOTE: YOU MUST DISABLE JAVA AND JAVA SCRIPTING!!!! You can do this
from Tools-->Internet Options-->Tab Security-->Custom Level. Or if
you don't wish to download anything while browsing you can do it by
setting security level to high.



--------------------------------------------------------------------------------


Finding Targets

Well we have gotten to a fun part. Now that you have your proxy set up
so people won't know who is snooping around there sites lets go
look. Make a list of your top ten or so favorite sites. You should
really try to pick sites that have a common theme like "cars that
drive fast" "cars with big head lights," "jerk out jaguars" or any
other nitch or genre of entertainment you can come up with that you
like. The idea is that people will use similar usernames and passwords
for similar types of sites (for instance you might find that a
christian rock members site might have alot of usernames like mark12,
LukeIsGreat, JohnSaves, etc, where as a member site for sail boats
might have names like SSloser, CaptnCantGetALife, SOS_Byatch, etc..).

These are the sites that you would like to get into, your "targets"
(of course I will assume that you have permission to brute force these
sites from the owner). Now what you want to do is go to the homepage
of each of your favorite sites and click on the members section. This
will bring up a dialog which will ask you for a username and
password**. Put in a few guesses for these; eventually it will come to a
page that says AUTHORIZATION REQUIRED and you won't be asked for your
username and password anymore or you can just hit cancle on the pop
dialogue. Try cutting and pasting this url again into another open
browser window to make sure that it asks you for your username and
password again, this is the url that we are going to try and crack. It
will most likely look something like cPanel or
http://someothersite.com/members/ Copy the url of this site and save
it to a text file (i.e. ~\Workspace\Combolist\Work\targets.txt); Now
we have a file 'targets.txt' that looks something like this.

cPanel
http://crackhere.com/members/
GETIN.COM
http://stayout.com/members/
http://members.yacracker.com
http://shipbuilding.com/members/
http://members.canshootingsite.com
http://dontlookformonkeys.com/members/
http://tarcanyourhead.com/members/
etc...




** Some sites have what is know as form varification, this is when a
site asks for a username and password directly in the webpage as
apposed to with the standard popup box. These types of site are
not covered here. More information on form logins can be found on
securibox.net



--------------------------------------------------------------------------------


Making combolists

Unlike most tutorials that I have come across on the topic of brute
forcing, which say you should find a combolist posted or "just guess
one" together, this one will give you the tools and ideas behind
making a first good set of combolists. Recall that a combolist is a
list of username-password pairs seperated by a colon. For example,

school:rocks
candy:cane
mydog:barks
today:tommorrow
joe123assword
etc...


When people post there passwords to forums they most commonly do in
such a way that it is a single click (assuming that you are NOT using
the latest patched version of IE, in the case that you are you will
have to type in the username and password by hand, I suggest getting
another browser or using one of the various patches to fix this). We
call these url's valid logins. For example,

http://joe:blow@members.sitestorys.com
http://joe:shmoe@othersite.com/members
http://guy123:guy123@shootcansfast.com/members
http://hello:darling@members.sizematters.com
etc...

Now is the time to take out your targets.txt file that you made
earlier. Also you should have google (or other searches) ready in your
web browser. Now we want to use your targets as part of our search
string. For example we want say that one of our targets was,

cPanel

then the google string would be

cPanel

or simply

@members.somesite.com

essentially you want to replace the 'usernameassword' in the url to
'*:*' so that google will match any username and password
pair. Googling this should bring up a few good hits (valid login
urls), if you don't get any hits then there is a few possibilities as
to why that is, but the bottom line is that chances are good that you
will not be able to brute force that site and another method will be
needed (this doesn't happen all that often). Reasons why you might not
get any hits is that either the site is really new and nobody has
cracked it yet, the site uses some other form of verification, the
site uses random password generation.

HINT: Use the grey 'cache' link that is under the big blue link in
google, this is almost always the best way to get the valid logins.

The program Athena does a series of generic google search to find huge
lists of valid logins. It is a good way to supplement the lists you
make in the above fashion.

Finding Valid Login Text With Athena

1. Click on Athena.exe

2. Click on Start (wait about 1-5 mins)

3. Click on Stop, the valid logins will be in (~\Athena\logins.txt).


Now that you have a list of valid logins in front of you, cut and
paste all the links to a validlogins.txt file and put it in
(~\Workspace\Combolist\Work). Try to ensure that there is only one
login per line. I find that Athena will sometime Smoosh two logins
together erase these if possible. Although using Athena alone with out
the manual googling is tempting I strongly recommend doing manual
googles. You should repeat the manual google for each site in your
list of targets. Try to get as many valid logins as possible this way
and suplement it with the generic Athena generated list. The reason
for this is because many time people list valid logins in a specific
genra class.


Now that you have a nice big valid login text file you are almost
ready to fire up VLStrip (Valid Login Strip), but first you must make
a keyword text file. This will be a list of words to look for within
each valid login. The idea is to make a list of keywords that are
relevant to the type of content that you want the combolist to be used
on. This will tailor the combolist for a certain purpose. So let us
say that you are interested in cracking sites that have pictures of
boats. You might have words in the keyword file like stern, star,
ship, captain, etc. and MOST importantly the names of all the websites
that are in your target list. So lets say that you had the following
target list,

QuickBoats.com | Quick Boats
fastships.com: The Leading Ships Site on the Net
http://members.harrycapt.com
Welcome to SinkingShip

then your keyword.txt file would be

quickboats
fastships
harrycapt
sinkingship
boat
ship
anchor
sail
ahoy
star
stern
etc...

Save your keyword.txt file in (~\Workspace\Combolists\Work). Now you
are ready to fire up VLStrip. Make Sure that the copy of VLStrip.exe
that you click on is located IN THE SAME FOLDER as validlogins.txt and
keywords.txt this should be (~\Workspace\Combolists\Work). The use of
keywords.txt is optional with VLStrip and I strongly suggest that
you make two lists one that uses it and one that simply strips off all
off the combos of every valid login.

USING VLSTRIP TO MAKE COMBOLISTS

1. Start VLstrip.exe in the same folder as validlogin.txt and
keywords.txt

2. When it asks for help you may wish to look around or else enter 'n'

3. Enter the name of the validlogin text, this should be
validlogin.txt

4. Enter the name of the keyword text, this should be keywords.txt you
may also, on a separate run try entering 'a' to strip off all the
combos of ever one of the validlogins

5. Enter the name of the file you would like to output to a good name
might be DATE_CONTENTTYPE.txt where 'DATE' is the todays date and
CONTENTTYPE is the content type that this list is geared towards.

6. You are given the option to make another list, you may wish to do
this.

NOTE: That if you use the same name for the output file as a file you
already have the old combos will be saved and the new ones will be
inserted. This means that you can grow your combolists over
time. Which means you can maintain or increase the effectiveness of
the combolist by finding more valid logins or updating the keyword
file. This also allows you to easily supplement your combolists with
some clever combos you may think of yourself. In this way the whole
cannon of combos will be ever increasing in the community of
crackers. This is the optimal situation.


--------------------------------------------------------------------------------


The Attack

Now that you have acquired a good size list of fast working proxies,
and created a combolis, it is now time to prepare and execute the
actual brute force attack against your respective targets (assuming
you have the targets permission; of course). First we must prepare
Sentry by configuring it's many options. Note that Sentry can do a lot
more then we'll mention here, but that is for you to discover as you
become more comfortable with the basics that I present here.


Prepairing Sentry

1. Open Sentry.exe

2. Tab Main -> Tab General Settings -> Slide Bots to a number in the
range 12-40, depending on your connection speed; more if you are on
a faster connection. This is the number of simultanious login tries
that will go on during the attack.

3. Tab Main -> Tab General Settings -> Set Length -> clik Enable
Length Filter. This sets a filter on the number of characters in the
username and password. The setting for this can be determined by
learning what are the requirements of the specific site. You can do
this by checking the specific target site. In addition many lists
of such specifications can be found on message boards including
securibox.net. If in doudt you can simply leave it blank.

4. Tab Main -> Tab General Settings -> Referer -> . This
makes it appear that the last page that you visited was the MEMBER
URL, you may also try some of the other options.

5. Tab Wordlists -> Click "little yellow folder icon" on top right of
white square box. Choose a combolist that you made or found for the
content type of the target.

6. Tab Proxy -> Analyzer -> Right Click on white space -> Open Proxy
List, choose the checked proxylist file you made. Note that there
are many other very useful options that you can use in the proxy
section of Sentry. As you learn more you should attempt to use and
understand these other options.

7. Tab Proxy -> Analyzer -> Click "little sweeper icon" -> Remove
Duplicates

8. Tab Proxy -> Analyzer -> Right Click on white Space -> Update My
List all

9. Finally, enter the target url from targets.txt into the 'site'
field on the top and click 'Start.'

--------------------------------------------------------------------------------


What to do if you get a hit.

First you are going to want to manually test the hits that you got
using IE or some similar browser. Lets assume you are using IE6 fixed
so the urls will work as is (see How_To_Restore_IE_http_verify.txt).

1. Tab History -> Right Click on one of the urls -> Use Proxy in IE

2. Tab History -> Right Click on the same url as above -> Launch in Browser.

With some luck you will be browsing the member section of the website,
congradulations you've just cracked your first site!


What to do if you get alot of fake replies.

Sometimes when you try to crack a site the site will, for whatever
reason redirect, you to somewhere else giving the appearence of a
successful hit. Sometimes this will be another site other times it
will be another page within the site. You will know where you have
been redirected when you try to enter memebers section using the combo
that was supposed to be a hit. This is a fake reply which may be
avoided using some of the options in the Fake->Tab section. What to
put in these sections can be tricky depending on the site. You should
look at the sentry manual section "Fake" and be creative as how you
wish to fill these boxes.


What to do if you get lots of bogus hits.

You may not wish to discredit all the hits in a list of hits which
seem to be full of bogus hits. Lets see if we can get around this a
smart way.

1. Vist the page that you are being sent to by redirects. i.e. use the
method above to check your hit.

2. Now that you have the page open on your browser, Click View ->
Source. Look over the source and try to find phrases which are
unique to the specific page like "Welcome to FakePlaceIsHere.com,"
"Get out of my stuff hacker!," or "Disabled Account."

3. Tab History -> Options -> Click Use Get

4. Tab Histroy -> Options -> Advanced -> Click "Check History Using..."

5. Tab History -> Options -> Key Phrases -> Click "Define HTML Key Phrase"

6. Tab History -> Options -> Right Click in the White Box and add the
unique key phrases that you found.

7. Click on the little yellow bolt of lightning to recheck the history.

With some luck you will have left only the valid logins.


What if you get no hits.

What you need is more information. The ultimate bit of information
would be a list all the username-password pairs that are active on the
site, this is where exploiting comes in, but we will leave that for a
future document. Failing this, we need to creat a wordlist which is as
as likley to hit as possible. First we are going to want to look at
the sign up section of the website. Try to go as far along in the sign
up proccess as possible without giving out any personal
information. With any luck you will get clues as to what the format of
the combo should be. For instance the username and password might have
to contain upper and lower case charcters or they might have to have
numbers as well as letters. You will be able to find out this
information by it either being posted directly or by reading up on the
billing company policy. Once you know what the combos must adhear to
you can better prepair a combolist for the specific site. You are
going to want to find a combolist editor eventually. A great tool for
cleaning a list is Gawk for a little more flexibility and manipulation
there is sed. With sed and Gawk together there is endless possibilites
for sprucing up a combolist. Others may wish to get a nice user
friendly combolist tool, but I have yet to find one that I find easyer
then sed and awk and none which have there power.


NOTE : There are many, many other useful options and settings in
Sentry that I have not touched based on, as they are beyond the
scope of this document, however, the user will very soon wish
to master these settings. You are going to want to read the
manual. When you are done reading the manual, read it again.

هناك تعليق واحد:

  1. Greetings! Very useful advice in this particular post!

    It's the little changes that produce the largest changes. Thanks for sharing!
    Look into my web site - Rob Poulos

    ردحذف