Brutus Tutorial on How to use it

 

How to use Brutus.

Written by: ALEX================================================== ========
I, The Author, take no responsibility for what you do with the information
that I am providing for you. This information is for educational purposes only.
================================================== ========

Chapter 1: Introduction to Brutus.

1.What is Brutus?

2.What can I do with it?

3 Where can I download Brutus?

4.Where can I find a good password list?


Chapter Two: Let's Get Cracking.

1.HTTP Form.

2.FTP.

3.POP3

4.Telnet.

5.SMB (Netbios)

6.Netbus

7.Custom.

Chapter Three: Wrapping up.

1.Contact Information.
========================================
Chapter One.

==What is Brutus?==

Brutus is a well known password brute forcing program.

==What can I do with it?==

With Brutus, you can brute force passwords for HTTP, FTP, POP3, Telnet, SMB (Netbios), Netbus, and they also have a
"Custom" option so you can specify your own settings.

==Where can I download Brutus?==
You can find Brutus at it's webpage www.hoobie.net/brutus
You can also find it at GluTuk's site www.spartandownloads.2ys.com

==Where can I find a good password list to use with Brutus?==
Pretty much, the only password list you will ever need
and has 4.9 million passwords. Here are a link where you can download it.

Part 1.
http://area51archives.com/files/pass_list.rar

Part 2
http://area51archives.com/files/pass_list.rar

================================================== ============

Chapter Two: Let's Get Cracking.

Note: You can use a proxy for each cracking method.

==HTTP Form==

This is the option you would use if you want to crack into a website that has a field for a username and a pass, like
this one.

http://www.westbranch.k12.oh.us/staff/controls.asp

I will use this site for the rest ov this section as well.

First thing you wanna do is open Brutus, and select http form. Then click the modify sequence button. Once there we put
the above link into the Target form field, then click Learn Form Settings
From here, you click the field name that is for the username, in this case it is userid, once you have selected it,
click the username button that is shown above the cookie information. That tells brutus that that field is for the username.
Then you select the password field and click the password button, then click accept. Next, in the HTML Response field you
need to fill that in with the response you get when you try to enter a password into your site. In this case the response is
"You have entered a wrong Password or username." For this target we will put that into the Primary response field Once this
is done, we click ok, add the IP into the Target Field and start our crack.

==FTP==

For cracking an FTP server, the default settings should remain how they are, I usually make sure that the "Try to stay
connected for unlimited attempts" box is ticked. That’s up to you, once you have selected your options, enter the IP and
being the crack.

==POP3==

This is pretty much the same as FTP cracking as far as, the default settings should work for you. Once again, I like to
use the "Try to stay connected for unlimited attempts" option.

==Telnet==

Seems as if I'm repeating myself, but once again, the default settings should werk for you.

==SMB (NetBIOS)==

If you happen to find yourself a target that has the NetBIOS port open (139) and has sharing enabled, but needs a
password, this is what you would use. Once again, default settings should work.

==Sub7==

Sub7 is a popular Trojan that sometimes, you might find a server that needs a password to connect.
This option is used for, cracking a password protected Sub7 server.

==Custom==

This is what you would use to set up a crack for anything else that you could think ov.You need to find out what you need
to put in each field once you click "Define sequence" Those options will vary from target to target.

How to run a trial software forever

In this post I’ll show you how to hack a Software and run the trial program forever. Most of us are familiar with many softwares that run only for a specified period of time in the trial mode. Once the trial period is expired these softwares stop functioning and demand for a purchase. But there is a way to run the softwares and make them function beyond the trial period. Isn’t this interesting?

Before I tell you how to hack the software and make it run in the trial mode forever, we have to understand the functioning of these softwares. I’ll try to explain this in brief.

When these softwares are installed for the first time, they make an entry into the Windows Registry with the details such as Installed Date and Time, installed path etc. After installation every time you run the software, it compares the current system date and time with the installed date and time. So, with this it can make out whether the trial period is expired or not.

So with this being the case, just manually changing the system date to an earlier date will not solve the problem. For this purpose there is a small Tool known as RunAsDate.

RunAsDate is a small utility that allows you to run a program in the date and time that you specify. This utility doesn’t change the current system date, but it only injects the date/time that you specify into the desired application.

RunAsDate intercepts the kernel API calls that returns the current date and time (GetSystemTime, GetLocalTime, GetSystemTimeAsFileTime), and replaces the current date/time with the date/time that you specify. It works with Windows 2000, XP, 2003 and Vista.

NOTE: FOLLOW THESE TIPS CAREFULLY

You have to follow these tips carefully to successfully hack a software and make it run in it’s trial mode forever.

1. Note down the date and time, when you install the software for the first time.

2. Once the trial period expires, you must always run the software using RunAsDate.

3. After the trial period is expired, do not run the software(program) directly. If you run the software directly even once, this hack may no longer work.

4. It is better and safe to inject the date of the last day in the trial period.

For example, if the trial period expires on jan 30 2009, always inject the date as jan 29 2009 in the RunAsDate. I hope this helps! Please express your experience and opinions through comments

How to Hack a computer using Metasploit ?

Metasploit is one of the greatest Hacking tools ever. It makes the hacking easy for the Script Kiddies (new hackers). But Question comes How to use it to hack a computer?

Metasploit Framework comes in command-line as well as GUI version. This article will deal with the command-line version. Followings are the basic commands of Metasploit that you should Learn by Heart.

1: help (show the commands.)

2: show info XXXX (to show the information on specified XXXX value, that is can be exploit or payload)

3: show options ( to show the options for a exploit and payload. Like RHOST, LHOST)

4: show exploits/payloads (to get a list of exploits/payloads)

5: use XXXX (to select the name of the exploit.)

6: set XXXX (to set the value of RHOST, LHOST or payload)

7: exploit (to launch a exploit on targeted machine.)

Note: To hack a computer using Metasploit first you should have the enough information of the target ­­including

1: IP address

2: Open Ports

3: services running

4: Version of software running

All of these need a little work. A famous tool to do all of these is NMAP on which I have written some articles.

Now the first step is choosing a right exploit for the vulnerabilities in the machine. To determine the exploit for the attack you need all the things noted above. For example the computer is running a SMTP server on Port 25 and there is a exploit on it than you hack that computer.

To choose an exploit following command is there:

Use [exploits address . e.g. Exploit/windows/smtp/xxx. ]

Now you need a payload (payload is a piece of program that will be executed if vulnerability is exploited). To get a list of all the payloads available for the exploit Just type following command.

Show payloads

Now choose an appropriate a payload from it. The only thing left is to set the fields for the attack. List of Most Probable fields to be set is given bellow.

RHOST = The IP address of the computer to be attacked.

RPORT = The Port of the service to exploited (it set by default)

LHOST = The IP address of your computer (it set by default)

LPORT = The default port of your Metasploit program (it set by default)

Now the Last step is to type the following command and Launch attack to the computer.

exploit

After typing this command the attack will be launched and if vulnerability is successfully exploited the payload will be executed and a shell (you can take it as command prompt) will be launched which will allow you to do anything with the computer that you have attacked.

How to hack a computer with Nmap and Metasploit

I have written different hacking articles about Nmap and Metasploit. Now I am writing this article to teach how to hack a computer using these two great tools.

Just got to http://www.metasploit.com/ and download the Latest Framework (not the mini version).

Now open the metasploit console. And type the following commands:

1: db_create (this will create database needed for this attack)

2: TYPE nmap -sT –sV XXX.XXX.XXX.XXX( X be the IP address of victim)

Now give it time to scan and when it is complete type following command.

3: db_autopwn -p -t –e

This would start the penetration test and great thing about this is that it does not need any manual configuration. Every thing will be done automatically and if the test is successful a shell will be created.