How to bruteforce botnet admin panel using windows

Sry for long posting but this is holiday in france

After reading an article on xylibox http://www.xylibox.com/2012/06/how-to-infiltrate-affiliate-programs.html

I have decide to show you how I bruteforce in windows for all people same me who hate linux, you lose time to run linux in VM with hydra

This method is called FUZZER, bruteforce form login is useless because very low and sometimes 

protected by captcha...

form login

.
Fuzzer method is bruteforce the request you send to the server with the username and password

live http header (firefox plugin), you can se the request

I teach you 2 method with different software one with webslayer and one with acunetix/burp suite
You need to download dictionnary for password
I used only admin for username
For password, I used this .txt 
For find admin panel, I simply used havij (panel finder) or google seach

#1 Webslayer method


you need to download : webslayer and live http header (firefox plugin) don't exist for chrome

Webslayer is the fuzzer, he don't sniff the http headers, you need to used for that live http headers.
First find a form login (botnet, exploit pack, istealer login planel ... or website too).
Send the link in firefox and open live http header and write 123456 or what you want in login and password, and copy this request :

Exemple of a request

After you past the link in Webslayer and modify the 123456 in admin (for login) and FUZZ (for password)
FUZZ is the text file with login or password you have choose
you can used FUZ2Z if you want used 2 dictionnary

Webslayer ready to start !

You have just to press start attack

If all is green, this mean fuzzer work, for find the good login and pass if location change or chars/code change ...
Just wait one night with and a day of work with a good dictionnary and you can find what you want :)
You can execute an unlimited number of webslayer :)



#2 acunetix/burp suite method


In this exemple I will show you only acunetix method because more popular than burp suite, but this is the same method for 99%

first buy acunetix with for 2000$, no this is a joke used a hacked credit card or used this cracked version 8 (last version)

At First got to this link and download acunetix scanner

http://www.acunetix.com/download/fullver8

ID: acunetixwvsfullv8
Password: nFu834!29bg_S2q

Then install it do not open it
If opened Closed it
Open patch and click on patch
Now open Acunetix you will be asked for some details

Enter below details
License Key: 2e3b81463d2s56ae60dwe77fd54f7d60
Name: Hmily/[LCG]
ComPany: Www.52PoJie.Cn
Email: Hmily@Acunetix.com
Telephone: 110

Patch Download Link:here

You need to download too another firefox plugin (yes if you prefer chrome this is not exsit)
Download foxyproxy

We used only the fuzzer of acunetix, don't used authentification tester this is not work with cracked version

Foxyproxy can send request to acunetix to the httpsniffer because if you dont used foxyproxy, acunetix cant sniff http for firefox

First find a url with form login, open foxyproxy and add localhost and 8080 same in this picture

foxyproxy option

After click on used the proxy localhost:8080 for all url

open acunetix and click on start for http sniffer

connect to your form login with 123456 for user and password

In the http sniffer find the request and right click send to http fuzzer

Http sniffer

Now we start fuzzing, add click on add generator and add file generator with 2 files one with login.txt and one other with password.txt (select filetype Text)
click on insert into request in you 123456 for login and pass and click on start

Http fuzzer setting

After you have just to wait same Webslayer

Http fuzzer in action

dont forget to stop http proxy sniffer and foxyproxy

Conclusion


For me acunetix is most fast than webslayer (for not a lot)
You can open only 2 acunetix in same time and a number of unlimited of webslayer
All night and for each day of work I used 2 acunetix and 5 Webslayer in same time
I try to access to botnet, exploit pack ... not only webshop too (but I dont do any ilegal activity)

One day with this method I found login and pass of a shop with lot of credit card in clear (not crypted)

Hacked cvv2

I dont resell them in shop or other (Im 100% White hat)
You can be surprised with fuzzing method, you can access to big website with a big dictionnary
(I would like show admin for big website I have but this is too many ilegal)
Personnaly I never access to a botnet or exploit pack now :( (just an istealer and a webshell)
Maybe xylito is better than me.

Dont do that for hacked website
If you have any question I am here

I used a lot acunetix not only for fuzzing, but scanning and other, I can rep to your ask with this penetration soft