Brutus Help [Good Intentions, not malicious!!]

ok, im new here at antionline, I use to visit another security forum but it seems to have gone offline the past 3 days now, so I decided i'd join this place :D
anyways my question is:
#1 is using brutus illegal
#2 I want to reveal a password I forgot on my website/email
#3 when i use brutus it only gives me the wrong password or a password from the top of my possible pass list

any help or comments would be appreaciated
please dont view this post as a malicious intent to begin cracking
I'm a good guy and I just need help on this :)

#1 yes it is illegal if u r caught(depends on countries)
#2 specify !!!whether it is e mail or website
#3 there are many brutus available try anater one and try to make u own in vc++ it is pretty easy.

well i see it as melicious intent but i selute ur way of asking for help to crack password so i won't give u any -ive points

Check your Brutus settings?

Could be that Brutus doesn't work, just a thought

ok ...yes it is illegal one reason " cracking is illegal" if you forgot your password (e-mail) contact the webmaster with the e-mail information ( name , adress and other things they required) so i wouldnt even try to crack an account or password ..... you should have another possibilitie then cracking your account if not just create a new one ....

I can see that your getting off on the wrong foot tenseikenz, read this http://www.antionline.com/misc.php?action=faq :), and you will feel at home and not being flamed ;).

BTW: welcome to AO, make your self at home.

Cya

Let's read the FAQ before we post....

1) Yes, cracking hotmail/website logins/anything is completely illegal unless you explict permission from the owner/company/etc.

2) Learn to remember things better! (What a stupid ass excuse for an attempt to help you break into someone's files.)

3) Thats not my problem... since using that program on an e-mail service which you are not the owner of, which is illegal, I'm not even going to tell you what you should do!

For those that don't know what Brutus is:

Quote:

---

Introduction

Brutus is one of the fastest, most flexible remote password crackers you can get your hands on - it's also free. It is available for Windows 9x, NT and 2000, there is no UN*X version available although it is a possibility at some point in the future. Brutus was first made publicly available in October 1998 and since that time there have been at least 70,000 downloads and over 175,000 visitors to this page. Development continues so new releases will be available in the near future. Brutus was written originally to help me check routers etc. for default and common passwords

Features

Brutus version AET2 is the current release and includes the following authentication types :

HTTP (Basic Authentication)
HTTP (HTML Form/CGI)
POP3
FTP
SMB
Telnet
Other types such as IMAP, NNTP, NetBus etc are freely downloadable from this site and simply imported into your copy of Brutus. You can create your own types or use other peoples.

The current release includes the following functionality :

Multi-stage authentication engine
60 simultaneous target connections
No username, single username and multiple username modes
Password list, combo (user/password) list and configurable brute force modes
Highly customisable authentication sequences
Load and resume position
Import and Export custom authentication types as BAD files seamlessly
SOCKS proxy support for all authentication types
User and password list generation and manipulation functionality
HTML Form interpretation for HTML Form/CGI authentication types
Error handling and recovery capability inc. resume after crash/failure.

---

= Cheers, jag291 =

Listen tenseikenz dude, each password your trying to hit is a request to your sites host. They'd be really pissed if you poked around with their login. Instead of doing it the kiddiot way... Do like everyone else said or just do a whois search for the peaple in charge of the domain and ask help from them.

yeah true, I shoud have contacted the domain pple first but, I though this was a security site, and well, I wanted to try doing it myself for a change, the best way to defend yourself against an attacker is to know his/her methods isnt it?well dont be narrow minded that just because brutus IS used by CRACKERS and malicious HACKERS that it cant be used to test your own vulnerabilities and hey, help you remember passwords instead of waiting like 2 weeks for that email to come with the password, but oh wait, you also forgot your email password!anyways just dont be so hostile in poking your finger saying evil!!, just like what society thinks today of ethical-hackers, and that which they cannot understand.
I mean no disrespect,please excuse me if I offend you in any way
please any ideas on brutus would be appreaciated

It seems as if you don't understand... people here aren't going to help you break into an email service.... its not because we think its unethical and we're *******s (which we are!) but because its illegal... learn to read.... and as for testing security... I highly doubt that hotmail or any other big name web e-mail service needs help from some little lamer like you!

= Cheers, jag291 =

Quote:

---

It seems as if you don't understand... people here aren't going to help you break into an email service.... its not because we think its unethical and we're *******s (which we are!)

---

Speak for yourself Jaguar291 lol.

tenseikenz: your best bet is just to try to contact the the admin like everybody else is saying.
LIke Jag said. just because you may be the actual person who has lost his password doesn't mean we are going to tell you how to crack your password.

You've been lucky with this thread. Most of the time people already have 2 red dots or have been banned with questions like these.

ok I see theres nothing here for me, delete this thread whoever the moderators are.
so I tread...

Hit edit, look around the top of the page, click the checkbox, then delete it yourself. And im sorry you were expecting all of us to spoon feed you.

Don't get the wrong idea about us here. If you ever need help with networking, networking security etc then this definitely is the place to come. We just don't do anything related to cracking, hacking.

actually we are so called white-hat hackers ....we like to explore systems and find/fix bug and error in them and we like to create a secure better OS then the one we buy .....

BTW: tenseikenz : im interested ...what was the URL of the other security site you visited ...>?

Quote:

---

Originally posted here by tenseikenz
well dont be narrow minded that just because brutus IS used by CRACKERS and malicious HACKERS that it cant be used to test your own vulnerabilities and hey, help you remember passwords instead of waiting like 2 weeks for that email to come with the password, but oh wait, you also forgot your email password!

---

Dude you just don't listen very well do you. You might own a site or email address but you don't own the things hosting this stuff. Each time your browseing a site or doing whatever on the web your sending out requests to some other guy's server. So unless you own these servers or domains or whatever how the hell is this testing "your own security". And if you have the time to waste on playing with some tool... then why can't you seem to find another two weeks to waste? P.S. like I said you can always do a whois seach and find alot of peaple to contact through both email, phone, fax, & (ect).

Quote:

---

Originally posted here by tenseikenz
just like what society thinks today of ethical-hackers, and that which they cannot understand.

---

You downloaded a tool which you cannot understand... and now you feel the need to preach to all of us about ethics? And if you really wanted to fully learn from other peaples tools why not go for something more open source? I mean atleast then you know how it works, what it does, and why... that would sure as hell be alot better than mindlessly downloading something then mashing random buttons like some kinda monkey or something.

I am new here and have seen many website with Brutus. I usually never sign up for forums, but I have seen to many people flaming others for asking questions regarding to cracking web mail passwords. Everyone says the same thing...ask the sys admin. or your local ISP. Uhhh? Has anyone ever tried to contact someone at yahoo? If so then you know that it is next to impossible to contact anyone from Yahoo.

I know because I have lost my password and can't even retrieve it because when the system asks me for my personal info regarding what is in my profile? I can't seem to match any of it up. Now I signed up with that exact email on 1/01 I believe. I never changed my password, I am guessing someone got in and changed my info. So before you judge everyone for comin in here and asking for ways to crack our own passwords try to be a little understanding. God forbid it happen to anyone besides yourselves.

I am not a cracker or hacker, I would like the knowledge that you all have. I am willing to learn but since a lot of you seem to have the god complex I doubt I will be asking any questions. To the rest that were kind enough to answer the original question. I am glad that there are still people out there who are helpful.

My only question is, how can I resolve this problem, get into my original email account and retrieve all my info and change my password and profile? Thank you.

if it is legitimate, and you want to speed up your brutus endeavors, make a list of the passwords you commonly use as the possible pass list. Don't email this list to your friends or anything, but if your brutus is just checking for the 20 or so password combos you tend to use instead of the 1000000 or so in it's list, then you're a little better off.

you also have a better chance of people believing you. if you honestly don't know if your password was "D0ntU53C4n0n2K1llSkitos" or "apple" then you may want to pay a little more attention to what you are doing.

just my two cents...
-sick

Quote:

---

#1 is using brutus illegal

---

Only if you use it on other people's systems without their authorisation. But you wouldn't be wanting to do that, right?

Quote:

---

#2 I want to reveal a password I forgot on my website/email

---

That isn't a question, that's a statement

Quote:

---

#3 when i use brutus it only gives me the wrong password or a password from the top of my possible pass list

---

That doesn't make sense either.

Seeing as it's your own system or you have permission from the admin, why don't you just go in and reset it?

If you're trying a security test on your own webmail system, be sure to tell the sysadmin that's what your doing otherwise you may create excessive load and/or trigger IDS rules on the system.

I'd recommend using it only out of hours on a non-production (for instance, internal development) system.

Using a password brute-forcer on a production or external system is likely to:

1. Trigger off IDS rules
2. Trigger automatic detection lockout (most large systems have this)
3. Create a lot of load on the client, server and the network
4. Really, really piss people off.
5. Oh yes, and you might get arrested and put in prison.

Brutus is no more illegal than a crowbar, which is to say: not at all. However, using Brutus OR a crowbar to break into something that doesnt belong to you IS. And Brutus works fine, I also reccomend CrackWhore 2. I will say this, if you try to brute force a web mail account you will probably crack the password around the same time you get out of prison, roughly 5 years or so.(This assuming a PW of 8 char) Have Fun!

-Maestr0