How2Bruteforce with AD serveral Login Pages.

[Lady Silvana]

Because I'm shocked how many people are still using wwwhack,
I'm writing this.


First what do we need?
+AccessDiver (www.accessdiver.com)
+Combolists

I'll use in this example euphro (no offense dude ;p)
but it uses the ip block.

1. I won't intro you how to install it... that should be clear. Now start it.

2. Click on 'My Skill' and Choose Expert, you should see now something like that.



3. Click on the tab 'Dictionary', you have now serveral features in AD how to edit
your combolist, you could also merge them or leech some... It's your choice.



4. If you may want to use proxies, goto the tab 'Proxy' and activate 'Use WEB proxies'.
'Rotate proxies' should be enabled. We've got now again lot's of features
but I'd prefer now to leech them, you could also load a list.
After Leeching you can add them into the analyzer,
I'm doing that to kickout slow proxies, but we won't take that now.
Select all proxies.



5. Now put the link of the Control Panel/Login at the top;
http://euphro.game-server.cc/cp/login.php as example.
Now look at the right side, there is a html button, do not click it... Click on the glasses.
'Find form datas of the current server' and enable 'Reiceive a cookie during a HTML test measn we found a weak login'.
Because Azndragons cp only give out a cookie when your valid logged in.
If you do not get a HTTP POST header in the textbox, try it again.

6. you could setup now serval more settings but its enough now.
If you setup it to 150 bots on the top, 150 Logins will be tested at once.

[tubelight]

i think that only newbies(me included) dont use accessdiver a lot, basically because it has too many features and we dont know how to use 90% of them.....

wwwhack is just more simpler, i agree that accessdiver is much better performance-wise, but then its like using a bicycle or a harley

[godofmadness]

Nice tut,explanatory and not spoonfeeding the noobs (because they're too dumb to set something up if you don't tell them how to do it step by step lol)

[KingJing]

nice tutorial <3
hmm you could link to the getting working proxy topic x_x

[eh1ryan]

nice tutorial thx

[caesarz]

Nice...!

[561687725]

nice guide , but an error message pop up in the fifth step ,it says:

HTTP Error #404(Code:10060) - Connection timed out (Error #10060)

Auto-detection failed - no POST Data found　! ! !

If you do not get a HTTP POST header in the textbox, try it again.

waht u mean by header in the phrase,, cause i m total noob in this thingy

i already download the extratool on official website that specially for winxp sp2, but it still has this error ,anyone can help me with it?

[Kyosis]

Where can i get some good combolists?

[caesarz]

Yeah, where i can find new / full combolist (without password at download).

I need that for brute force...

[Lord Cedrich]

I've got this 72mb combolist from GSO http://rapidshare.de/files/8909183/BendersWordlist.rar.html
i hope this file can help you guys

[genesis234]

Thanks a lot cedrich. Very nice list.

[LightFighter]

Lady Silvana didnt write this Tutorial herself >_>
he copied it from the Tutorial from the elitepvpers forum
here the original thread from Marie: http://www.elitepvpers.de/forum/index.php?act=ST&f=124&t=7952&s=

[Xearo]

its the same person, just different names.

[LightFighter]

really?
oh.. sry^^

[Kyosis]

Thanks for the list Cedrich =P

[God]

can somebody elaborate more about the proxy thingies?

[Azoka]

Sorry for the small "revival", but I have some questions.

When I try to do what you say at step 5 (Find FORM datas for the current server) it bugs and says "Auto-detection failed - no POST data found!!!

Try the HTTP debugger to possibly find those datas. This tool is in the Extra Tools section of AccessDiver." So I go to Extra Tools, HTTP debugger.. put the link to the login.php, select  "POST" mode, click on connect and it says "Nothing to POST".

Is it because there's something new in the CPs now ?

Oh and second question, where is the "Receiving a cookie during a HTML test means that we have found a weak login" option? <=  EDIT: nevermind that. I found it.

Thanks a lot.

[clavat]

Would 150 bots logging in at once crash a small server? Or do I need a different means to test it?

Edit: I'm running newbie mode on the EuphRO CP, with 150 bots, on the proxy 216.133.248.227:80, that won't affect anything right? Because expert mode hates my proxies, so I had to downgrage.

[Krai]

how can i make a new combo list for my specific server?