how do you hack Strongbox secured sites?

how do you hack Strongbox secured sites (OCR)?

seen many sites with strongbox which have been hacked and passes shared in password section

how do they do it...?

thanks in advance

[sPlico]

Answered at least 100 times. Some sites have the "bluff" mode on, which makes them normal forms. Other are exploited.

thanks for fast answer (sorry if its been up that many...)

I'm only experienced in bruteforcing... so by exploiting, what do you mean exactly? something like searching for .cgi files (what are those?)? with which software (accessdiver?)?

thank you for your help

[slysnake]

I'm only experienced in bruteforcing... so by exploiting, what do you mean exactly

It seems you know more than you are letting on. ;)

[daemon.azazel]

yes many sites equipped by strongbox was exploited
because of their relationship to AWW cms, both products
are supplied in one pack.

strongbox + AWW is very same as sparta + NATS

well hit 'karisweets.com' with +-5000 combos, not gonna waste any more proxies on trying bruteforce, probably isnt fake OCR but the real deal (I thought C-force can hack Strongbox, see's a difference in reply, thought someone in pass section said he does it with C-force, but never worked for me)

any clarification on AWW cms, sparta + NATS, cause that doesn't ring a bell for me...

thanks for your excellent expertise ;)

[sPlico]

Originally Posted by daemon.azazel

yes many sites equipped by strongbox was exploited
because of their relationship to AWW cms, both products
are supplied in one pack.

strongbox + AWW is very same as sparta + NATS

Well, even more of them got exploited because of the certain "combos" :P

[FlowerHorn]

Like sPlico mention before, some strongbox ocr sites are "bluff", which isn't fake because it does require the post data <code> reading along with the user/pass. For example, karisweets and ravenriley are non-bluff, therefore, you trying to bf it won't work. Some ocr sites work with c-force if you use cookie manipulation, but that's another story :)

lol @ sPlico, "certain combos" I know what you u are saying there bro :)

[grzesiek]

karisweets.com has generated passes, only few are user chosen
and yes, it has ocr on. the good thing is you don't need any "certain combos"
(me sure daemon knows what i mean)

so something like exploiting: find the .cgi file, which contains passes, decrypt it and so on...?

(been reading on the forum, but not yet found how and with what best..., but will search some more later...)