This is authforce.info, produced by makeinfo version 4.0 from authforce.texi. This file documents authforce, an HTTP authentication brute forcer. Copyright 1990 Free Software Foundation, Inc.  File: authforce.info, Node: Top, Next: Overview, Up: (dir) authforce - HTTP authentication brute forcer * Menu: * Overview:: Features of authforce. * Usage:: Using authforce * Invoking:: authforce command-line arguments. * Examples:: Examples of usage. * Contact:: Contacting the author * Concept Index:: Topics covered by this manual.  File: authforce.info, Node: Overview, Next: Usage, Prev: Top, Up: Top Overview ******** Authforce is an HTTP Authentication brute forcer. Using various methods, it attempts brute force username and password pairs for a site. It has the ability to try common username and passwords, username derivations, and common username/password pairs. It is used to both test the security of your site and to prove the insecurity of HTTP Authentication based on the fact that users just don't pick good passwords. Furthermore, authforce is free software. This means that everyone may use it, redistribute it and/or modify it under the terms of the GNU General Public License, as published by the Free Software Foundation.  File: authforce.info, Node: Usage, Next: Invoking, Prev: Overview, Up: Top Usage ***** For basic usage, make sure the data files have the data you want, and then run authforce with the argument being the url of the site you want to brute force. At the moment, it is not possible to disable a method, but you can get the same effect by making it use an empty data file. For example, I don't usually use the concat method, because the datalist I have for it sucks. The major special item that may cause a little confusion is the session support. I think it works :P. Start up authforce with the -s option (for session support) and let it run. When you want to stop it, kill it with USRINT (^C or kill -INT pid) which will cause the program to write its current position to session.save (by default) and quit. Then when you want to resume the session, type authforce -r. The data lists are very sparse at the moment. Make your own or find one. Programs like John the Ripper have good lists, although you usually don't want yours that long. If you make a good list of your own, please contribute it. The password.lst file has a new syntax now. Along with regular passwords are the keywords {username} and {emanresu} which insert the username and the username reversed, respectively. Things like {username123} and {usernameemanresu} are valid (and encouraged!). If you have any ideas for other keywords, please let me know. If you compile with the development CFLAGS, and you wish to leave in -DMEMWATCH, you'll need to get memwatch from: `http://www.link-data.com/memwatch-2.64.tar.gz' Put memwatch.c and memwatch.h in the authforce directory and compile. It is really a great program and I recommend you use it for your own projects. P.S. Memory leaks are spawned by the devil. Elimate them for me and I will be very happy. To find the ones I know about, grep for MEMWATCH.  File: authforce.info, Node: Invoking, Next: Examples, Prev: Usage, Up: Top Invoking ******** By default, authforce is simple to invoke. The basic syntax is: `authforce [options] URL' The program returns 0 if no matches were found, and 1 if atleast one match is found. The directory /usr[/local]/share/authforce contains the data files containing usernames and passwords. `-b' Beep when a match is found `-d' `--debug=NUMBER' Set debugging level between 0 and 5 `--dummy-file' File containing dummy matches. [username:password form] `-h' `--help' Display help and exit `-l FILE' `--logfile=FILE' Set logfile to FILE `-r' `--resume[=FILE]' Resume old session (using FILE) [default session.save] `-s' `--save[=FILE]' Save session on SIGUSR1 (to FILE) [default session.save] `-c' `--max-connects=NUMBER' Don't make more than NUMBER connections `-u' `--max-users=NUMBER' Don't try more than NUMBER users `-U' `--user-agent=STRING' Set user agent to STRING `--pairs-file=FILE' File containing username:password pairs `--password-delay=NUMBER' Delay for NUMBER seconds between attempts `--password-file=FILE' File containing common passwords `-p' `--path=STRING' Look for pathlist STRING `-P' `--proxy=STRING' Set proxy to STRING `-q' `--quiet' Don't output to stdout `--user-delay=NUMBER' Delay for NUMBER seconds between usernames `--username-file=FILE' File containing list of usernames `-v' `--verbose' be verbose (default), opposite of -quiet `-V' `--version' Print version information and exits  File: authforce.info, Node: Examples, Next: Contact, Prev: Invoking, Up: Top Examples ******** In this chapter we'll give you some examples to help you getting started. authforce http://www.mywebsite.com/members/index.html Search for a login/password combination on the given URL.  File: authforce.info, Node: Contact, Next: Concept Index, Prev: Examples, Up: Top Contact ******* Please contact me. Even if it is just to say that you are using the program. Feedback helps me understand how well I'm doing :P Feel free to send it gpg encrypted too. You know, so 'they' can't intercept it. You can always download the latest version of authforce at `http://kapheine.hypa.net/authforce' Email the author at Get his GPG Key at `http://kapheine.hypa.net/kapheine.asc' so you can use secure mail.  File: authforce.info, Node: Concept Index, Prev: Contact, Up: Top Concept Index ************* * Menu: * Sample index entry: Overview.  Tag Table: Node: Top201 Node: Overview564 Node: Usage1291 Node: Invoking3199 Node: Examples4849 Node: Contact5151 Node: Concept Index5704  End Tag Table