search

NetSPI / httpillage

MIT License
25 stars 3 forks source link

Bruteforce payload #23

Open forced-request opened 8 years ago

forced-request commented 8 years ago

By default we'll leverage the following charsets over a fixed length. Custom charsets will be implemented later.

?l = abcdefghijklmnopqrstuvwxyz
?u = ABCDEFGHIJKLMNOPQRSTUVWXYZ
?d = 0123456789
?s = «space»!"#$%&'()*+,-./:;<=>?@[\]^_`{|}~
?a = ?l?u?d?s
?b = 0x00 - 0xff

Following examples ?l?l?l?l?l -- aaaaa - zzzzz ?d?l?l?l? -- 0aaa - 9zzz abc?d? -- abc0 - abc9

The C&C server will delegate work by issuing smaller charsets to nodes, generally of length four (4).

Total charset: ?l?l?l?l?l?l -- aaaaaa - zzzzzz

Node one: aa?l?l?l?l -- aaaaaa - aazzzz Node two: ab?l?l?l?l -- abaaaa - abzzzz ... Node one: zy?l?l?l?l -- zyaaaa - zyzzzz Node two: zz?l?l?l?l -- zzaaaa - zzzzzz

Atticuss commented 8 years ago

shouldn't abc?d? be abc?d ?

forced-request commented 8 years ago

Yep, a few wrong examples here. Got carried away with the ?'s