 |
Menu |
 |
|
 Home |
| |
|
 Discussions |
| |
|
 Tools |
| |
|
| Affiliates |
| |
|
 Content |
| |
|
 Info |
| | |
|
|
|
|
|
User Info |
|
 Membership:
 Latest: MichaelSnaRe
 New Today: 0
 New Yesterday: 0
 Overall: 9144
 People Online:
 Visitors: 61
 Members: 0
 Total: 61
|
|
|
|
|
|
Full disclosure |
|
|
|
 |
|
 |
 |
|
 |
IT Security and Insecurity Portal |
|
|
Get all PhpBB usernames to help with Dictionary Attacks. |
|
 Posted: Thu Nov 20, 2008 7:30 pm |
 |
|
| renaker |
| Active user |
 |
|
| Joined: Nov 15, 2008 |
| Posts: 27 |
|
|
|
 |
|
 |
|
Waraxe was pointing me in the right direction and suggested I work on creating my own wordlists. He gave me multiple suggestions of places I could go to find these letter combos. One of his suggestions was to gather every username from a phpbb forum. Out of interested i made a short script that grabs all Phpbb usernames from a specific forum, only uses ones less than 15 char, and converts them to lowercase. If it's of use to you you:
| Code: | <?php
//Put in proper forum URL
$url = 'http://www.SOMEWEBSITE.com/phpBB2/memberlist.php?start=';
$num = 0;
$file = "phpbb_users.txt"; //Name of the txt doc where the results will be saved.
$handle = fopen($file, 'a');
while($num !== -1)
{
$found = 0;
$lines = file($url.$num);
foreach($lines as $line_num => $line)
{
if(strstr($line, '<a href="profile.php?mode=viewprofile&'))
{
$user = explode('" class="gen">', $line);
$user = explode('</a></span></td>', $user[1]);
$user[0] = strtolower($user[0]);
$len = strlen($user[0]);
if ($len < 16)
{
fwrite($handle, "\n".$user[0]);
echo "\n".$user[0];
}
$found = $found + 1;
}
}
if ($found < 1)
{
fclose($handle);
die("\n\nCannot find anymore usernames. Your wordlist has been created. PHP DIE...\n");
}
$num = $num + $found;
echo "\n\n\nAt User # $num\n\n";
}
fclose($handle);
?> |
Thanks waraxe :) |
|
|
|
|
|
|
|
|
| Posted: Thu Nov 20, 2008 7:57 pm |
|
|
| lenny |
| Valuable expert |
 |
|
| Joined: May 15, 2008 |
| Posts: 275 |
|
|
|
|
|
|
|
Very usefull, you'd be suprised how many people use their username as their password 
No, really.
With some slight adaption this could come in very usefull |
|
|
|
|
| Posted: Thu Nov 20, 2008 8:17 pm |
|
|
| waraxe |
| Site admin |
 |
|
| Joined: May 11, 2004 |
| Posts: 2407 |
| Location: Estonia, Tartu |
|
|
|
|
|
|
Nice work
Now we need automated way to gather as much as possible phpbb installation URI-s  |
|
|
|
|
|
|
|
|
| Posted: Thu Nov 20, 2008 9:33 pm |
|
|
| renaker |
| Active user |
|
|
| Joined: Nov 15, 2008 |
| Posts: 27 |
|
|
|
|
|
|
|
Well, I was going to write a script that gets Phpbb url's (like you mentioned^) and then get all the usernames - loop, but it seems google expects this sort of behavior. Maybe I should try a less popular search engine.
| Quote: | Google
Error
We're sorry...
... but your query looks similar to automated requests from a computer virus or spyware application. To protect our users, we can't process your request right now.
We'll restore your access as quickly as possible, so try again soon. In the meantime, if you suspect that your computer or network has been infected, you might want to run a virus checker or spyware remover to make sure that your systems are free of viruses and other spurious software.
If you're continually receiving this error, you may be able to resolve the problem by deleting your Google cookie and revisiting Google. For browser-specific instructions, please consult your browser's online support center.
If your entire network is affected, more information is available in the Google Web Search Help Center.
We apologize for the inconvenience, and hope we'll see you again on Google. |
|
|
|
|
|
|
|
|
|
| Posted: Thu Nov 20, 2008 10:21 pm |
|
|
| waraxe |
| Site admin |
|
|
| Joined: May 11, 2004 |
| Posts: 2407 |
| Location: Estonia, Tartu |
|
|
|
|
|
|
| First, there are tricks to partly overcome this restriction. And second, there are Yahoo and MSN. Best option is to get as much as possible from all of the three search engines and then compile one huge masterlist, where all URL-s are checked. |
|
|
|
|
www.waraxe.us Forum Index -> PhpBB
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
|
All times are GMT
Page 1 of 1
|
|
|
|
Powered by phpBB © 2001-2008 phpBB Group
|
|
|
|
|
|
