Cannot find form data on this site

Tried all the auto-detects on www.realpunting.com , this site used to be basic auth and was no probs, switched to form with OCR but I'm positive the OCR is just for show and not used as part of the authentication process as I can find no reference to it in the "submit" part in the source of the form.

Am I doing something completely wrong ? I have tried the /members and /auth.form and CForce and AD state it's not a html protected site.

I don't want spoon feeding just a hint at where I'm going amiss.

Any help would be great.

[slysnake]

where I'm going amiss.

By depending on auto detect of some bruteforce program to find the info you want. Learn what to look for yourself. Get firefox with live http headers and see what's happening, then you will have a better understanding. With understanding comes power.

Thanks for the info. Added live http headers.

Post data is as follows :-

rlm=RealPunting+Members+Area&for=http%253a%252f%252fwww%252erealpunting%252ecom% 252fmembers%252f&uid=test&pwd=testpass&img=IYbd&submit=submit


I can fire away at http://www.realpunting.com/auth.form?rlm=RealPunting+Members+Area&for=http%253a%252f%252fwww%252erealpuntin g%252ecom%252fmembers%252f&uid=test&pwd=testpass&img=IYbd&submit=submit

but I notice the variable "img" is posted to the server, how can you tell if this info is actually used by a server side script without viewing the source. How do you tell if a site uses genuine OCR checking or if it's all for show/to deter.
if the OCR is used I will just get the failure keywords and never know if its the OCR or bad user/pass combo.

Once again thanks for the advice.

[sPlico]

Originally Posted by jamie_p

how can you tell if this info is actually used by a server side script without viewing the source. How do you tell if a site uses genuine OCR checking or if it's all for show/to deter.
if the OCR is used I will just get the failure keywords and never know if its the OCR or bad user/pass combo.

You can't really be sure about that unless the website gives you some kind of error message stating differences between bad user/pass combo and ocr image.

Thanks for the replies.. much appreciated.

One method I used to use (long time ago when @form was the tool) was find one login via form then hit a link inside thats basic auth.

Used to use that with easynews, form login but if you hit /survey or /edit you could crack it with GE. (Showing my age now). Been absent for a long while and my old sploits will be long gone. Time to get back into it.

[sPlico]

You can find hidden popups in forms through intellitamper tool. I actually fired that yesterday, and it started downloading several .rm files, and after that, site went down. I don't have a substantial connection to make it go down, unless they're hosted on some poor server:P

Anyway, i found no popups because when it started to download those files, i stop'd.

[slysnake]

Really, as sPlico said, the best way to determine if the OCR is a bluff is simply to put a fake code in the box and check the response. If you get back "wrong user:pass" probably a bluff. If you get back "wrong code" probably active.

Thanks.. I tried that originally and it always returns you to the main auth.form regardless of what OCR or User/Pass. I ran intellitamper but as with above it hung after downloading. I'll keep plodding away and try get a login, failing that whack it with nmap.

Once again, really appreciate you guys replying.

[[C-K]]

been my experience that sites using /auth.form are not recognized by cforce..beta or original..

Seem to be correct.

I'm happily firing combo's at it now via AD (pains me to say it) and its merrily chugging away detecting failure keywords. I have no way of knowing if its a bad user/pass or bad OCR since it just seems to direct you back to /auth.form regardless of correct/incorrect OCR. I will perseve though, keep probing is my moto.