Suprisingly easy CGI dictionary attack...

Before reading, please know that my intent is not malicious. I seek only to point out the poor security of many CGI login forms.

I recently wrote a simple batch file that ultilized cURL to carry out a limited dictionary attack on a CGI program. If anyone is unfamiliar with this, cURL is basically a command line tool for making HTTP, FTP, etc requests. I used 2,000 common passwords. It was suprisingly easy, and could be summed up in one line:

FOR %%pass IN (list) DO CURL -d "username=username&password=%%pass" site.com/cgiprogram>>results.html

I tested it out on a smaller scale on my own account on one of the various webservices I use, and suprisingly, it worked. It scares me that with my limited experience in programming, I was still able to do this. It's also alarming that many sites still have unlimited login attempts.

Ok... what exactly is wrong with this post?

It does not in any way deserve the bashing it has apparently recieved.


Shame on y'all.


If you have a problem with this, say something. Defend your position in the public forum, not behind a facade of APs.

Ok, I'll say something publicly that I told the OP in private - why I was the 2nd to neg him, and his thread:

Quote:

---

Talking about the issue is fine. Giving the 'how to' is NOT. Read page 1 of AO titled 'What AntiOnline IS'

---

For my reasons on negging the thread too, read why for yourself.

now was that such an issue that you had to bring this thread back to the top where he'll get negged further?

Well, I gave the guy some positive AP's. Although giving a 'how to' can be used for malicious purposes, it can also be used to help educate us on how to defend against it. By showing us an example of the code, we can at least begin to understand how the attack works.
Basically what blithendell did, was warn all of us how this potential attack is structured. I see nothing wrong with that.

Did I miss something? Where was the bashing of the thread?

Ice:
I'm usually in agreement with you on most stuff but I disagree with you here. I dont have a problem with the posting...I see it as an educational/pen-testing help.

It's stuff like this, sharing of code/techniques, that makes this site more of a security site.

Maybe I'm just in a good mood right now. dunno ;)

no big ric-o, I shut my head after getting balanced anyway. Maybe I was in a pissy mood. Who knows? Who cares? :P

Howdy.

Very interesting find there blithendell.
It's amazing how taking the simplest route can get you similar results.. ;)


cheers
front2back

how we learn is reading stuff like this , you cant fix something unless you know how it got broken in the first place, it looks like to me he was showing an example rather than giving a step by step howto

Well,

The actual method is trivial, in that all it basically does is automate an iterative process. It is neither rocket science nor malicious per say IMO. After all you could sit in front of the screen with the list and key them in manually couldn't you?

There are two basic issues raised:

1. Don't use dictionary words, common passwords or default passwords (even if the default is for something entirely different), as they are likely to be on the list.

I would say that this is pretty much common knowledge amongst people who visit security sites.

2. Some sites have unlimited login attempts.

Now that is one for concern, as you may have already comitted private information before you find this out? and you may not be able to close the account of your own accord?

This emphasises the need for a long and strong password if you wish to use such sites. I know there are those who think that long passwords are actually a security problem, but they don't have to be.

Say you chose Password..................not a very good choice, so let's say it is pa$$W0rd and this is your "core" all you need to do is pack it out a bit:

wXyZpa$$W0rd9876 ................. then a bit more................ [€wXyZpa$$W0rd9876$]

Now that would be impossible for a dictionary attack over the internet, and is quite easy to remember because it is modular in construction. As it is 20 characters it would even defeat most rainbow tables that are readily available or constructable.

But, at the end of the day the solution is for the site to allow 3~5 attempts then drop the connection and lock the account for a period. In that situation the probability of finding even a 6 character pass is well nigh zero.

Another mitigating factor in these sorts of attack is that they are over the internet, and effectively require you to fill out and submit a "form" for validation. That is one hell of a slow process

;)

Its a shame that the ethics of people must nannyied with the use of AP's.

Surely information the majority of the information on this site could be used for misdoings, however it is the responsiblity of the individual to realise the ethical/ legal implications of doing so.

AP's will not change a persons interest in a subject and in effect it is promoting censorship which isnt what the internet is about, however i realise that AO and Jupitermedia are of course welcome to take these actions, it just doesnt provide a learned environment, university libraries provide books on subjects such as explosives, missle systems, and Nazi ideology, yet it is left to the responsibility of the indivdual to decide on his/her actions with this knowledge.

Anyway thats my take on it.

i2c

i2c

Quote:

---

the majority of the information on this site could be used for misdoings

---

Hmmm, when am I going to get access to the hidden forum :D to be honest with you mate, there is very little in the forums on this site that could be used for wrongdoing. If it isn't solving specific problems, it is discussing current events and issues or recommending defensive strategies.

I certainly do not recall having see anything that can be used "off the shelf" so to speak.

Anyway, the majority of the content isn't even security related.

:)

Yea, it's pretty simple for you and I just to say that we need to use stronger passwords. But what about the rest of the net? When I saw the list it actually suprised me, because a password I had used when I was just a kid was on there.

List of Common Passwords (Again.. intentions not malicious... first result off Google)

And yea, nihil, it's not the greatest (or fastest) method out there, but it's only one line, and effective against simple passwords..

The bashing I referenced was AP assignment(s) to the original post.

nihil i think there is information that the creative could use, for instance i could plan an attack bassed on the typical policy thats discussed widely here, the addicts forum even had a subject in the last 6 months regarding the construction of an RAT.

I certainly agree with you that the information i percieve as being useful to the "creative" isnt glaringly obvious but its there in my eyes, even if its just words or techniques to lookup on google. thehorse's tutorial on "hping" is alsp another good example.

Prehaps im incorrect and to creative, but thats certainly my take on it, this post is certainly no worse that the firemapping section of the Hping tutorial series, and there was no fuss regarding that.

i2c

Hey, blithendell , don't get me wrong, I do not think that your post was wrong in its content.........you might have given us a bit better clue as to the direction you wanted it to take?

I took the speed of online cracking, cracking methodologies and password strength..........but that was just pulled out of the air :)

I appreciated what you were saying, and that it is a problem amongst non-cognoscenti. Where I really picked up on your line was the number of sites that allowed unlimited connection attempts, that is really bad unless it is some sort of home hosted affair?

:)

i2c

I still don't think that there is anything in the forums that would be directly useful to a malicious person. It will take a certain amout of knowledge to even get half way?

Yes we may be a trifle over paranoid.............so just post your zero day exploits in hardware?

Well it may cause a certain stiffness amongst our "security experts in their own imagination"

:p