Brute Force Tool

A person can use this tool, combined with a cgi proxy or other program like a proxy filter to brute any data in a request sent to a sever. Comes with basic tutorial, but it can do a lot more. Most brute force apps I've seen are specifically for combos and post or get data. I'm trying this myself because I needed something to brute short basic authorization codes (user info encrypted) and session cookies. I'm optimistic but if anyone else has any info please post..

http://rapidshare.com/files/34510034/Crowbar.zip.html

no pass

[slysnake]

Is this your tool? It's new to me. I'll have a look

No, not mine. I found this somewhere and thought it could be usefull. Also, It has a major disability (it cannot use a proxylist). I found a couple of ways around this.

[sPlico]

Can't use proxylist? what's the use then?

there are a couple of different ways, but here's what I'm using:

Local proxy servers can send each request made by your computer using different a ip (auto rotate). So there is a proxy list; it's just used by the local proxy sever. The requests made by programs on you computer are modified before they are sent out; no program compatibility required.

this is my fav and it's freeware
PROXY FIREWALL (proxy-firewall.c0m)


here's a good and short pdf about hijacking sessions websites. No need for user name and pass.

http://rapidshare.com/files/34860001/SessionIDs.pdf.html

OK,

I had success with my test on basic authentication sites like: mike's apartment, bangbros, Lightspeed ... (turned combo list into a basic auth list using a base64 decoder and used crowbar to brute)


Now it's time to try the ocr sites using session info: (no need for something that can recognize characters in images, maybe EASIER OCR,AVS access)

I'm going to make out profiles for the sites, I'll need to login first to see what type of info I need to come up with. kinda like this.

Cookie: PHPSESSID=a775fc584432d6fb16ab125f6fc81601; path=/

(Anyone know what method is generally use to encode/encrypt this info; I just started searching)

I've read that some are a random string that use as a key to look up the session information.

P.S.
Anyone know what happened to the strongbox old admin login cred (died like everything else). Props to JaNlOk for the long list. And has there been success with other flaws.