This is a tutorial about how to perform a dummy dictionary attack and how web-masters can prevent a dictionary attack.<\/p>\n
Wikipedia defines Dictionary attack<\/a> as, In this post, I’m going to write a simple code which will send POST requests to the web server and process the response of each request. Before I start, let me tell you that there are many softwares which already do this. Some of them are,<\/p>\n 1. Burp Suite<\/a> But what’s the fun in using a software and cracking something. \ud83d\ude42 The fun part is when YOUR code does something. After all, Code is Poetry<\/em> (Check wordpress.org footer) \ud83d\ude09<\/p>\n For the demo here, I have this login page<\/a>, which is very similar to my college mail server (or any horde server). The user-name and password for a successful login is “cs10528” and “remember” respectively. If you provide a valid user-name\/password combination, the page will display “Login Successful”. For any other user-name\/password combination, the page will display “Login Failed”. So, now all we need is a code which can send POST request to the login page and a dictionary from which we can pick up the probable passwords.<\/p>\n This is the PHP code<\/a> I’ve written to automate the login process. It reads from the “dict.txt” file and uses that to send the HTTP request. The code is well commented and main login process is done by curl functions. And finally, here is the dict.txt<\/a> I’ve used for this demo. It has only around 25 words, so that the processing ends sooner. In case you are not comfortable with curl in php, you can see this post<\/a>, which explains about curl basics.<\/p>\n You can see the whole login process in action here<\/a>.<\/p>\n So, how can a web-master prevent these automatic logins?<\/strong><\/p>\n
\n
\nIn cryptanalysis and computer security, a dictionary attack is a technique for defeating a cipher or authentication mechanism by trying to determine its decryption key or passphrase by searching likely possibilities.
\nA dictionary attack uses a brute-force technique of successively trying all the words in an exhaustive list (from a pre-arranged list of values). In contrast with a normal brute force attack, where a large proportion key space is searched systematically, a dictionary attack tries only those possibilities which are most likely to succeed, typically derived from a list of words in a dictionary. Generally, dictionary attacks succeed because many people have a tendency to choose passwords which are short (7 characters or fewer), single words found in dictionaries or simple, easily-predicted variations on words, such as appending a digit.
\n<\/code><\/p>\n
\n2. John the Ripper<\/a><\/p>\n