A Dictionary Attack for Twitter

A dictionary attack is an attempt to crack a password by trying a list of logical passwords from a list of commonly used dictionary words.

Today, I'm pleased to release a dictionary attack which can obtain the password of Twitter users. The program itself is entirely free and legal. It should not be used illegally. I am not releasing the source code to it at this time.

There are two flaws with this dictionary attack. 1)Like the bruteforce attacks I released for Twitter, this program does not stop trying passwords once it finds the correct one. So you will need to watch the Twitter account of your victim. When the victims account tweets the tweet you wanted it to tweet, stop the program and view the LOG file it outputs to figure what password it used was the right one. 2)The dictionary list included with this program is not very good. A lot of the passwords in it are actually too short to be Twitter passwords >_<. If anyone can make or find a better list, let me know and I'll update the release with it.

If you're a concerned Twitter user over the vulnerability of your password, just put a number in your password and this attack will not be able to obtain your password. However, other and future Twitter attacks will be able to (until Twitter fixes the flaws in their system of course).

Finally, note that this release can obtain most passwords which do not use numbers within a weeks time. It can not obtain any passwords which contain numbers. It is overall much faster than the bruteforcers I have released previously due to the nature of dictionary attacks.

You can download the dictionary attack here.

You can view my previously released Twitter attacks here.

If you have any questions regarding the content of this post, feel free to leave a comment, join me in #arikadosblog on EFNET, post in our forums, tweet to me, or send me an e-mail at castlevania7689@yahoo.com

Lastly, if you can, please donate to my college fund using the chip-in widget on the right-hand side of this blog.

Twitter Bruteforcers v1.1 Released

I've fixed a few issues with all of the bruteforcers. The proxy stuff should now work correctly and you should be able to enter in a custom status message to tweet when successful now. The randomized bruteforcer now handles only bruteforcering a single character number too (example, you can now enter 6 for the min and max values and it will only bruteforce 6 character passwords instead of hopping around between 6 -7 character sizes)

Again, do NOT use these programs illegally. I do NOT support or condone doing that.

Check the original post for the new links.

Twitter Bruteforcers Released

Well, turns out there's a reason I've been doing so much blogging about how bruteforcers work and whatnot! I've written three for the popular (and my favorite) social networking website Twitter!

For those just tuning in, a bruteforcer is a program which cracks passwords by trying every possible password combination until it tries the correct one. Thus, these Twitter bruteforcing programs can figure out the password to any Twitter account eventually.

The first bruteforcer is the sequential ascending bruteforcer which tries every possible password from the bottom up. The second brutefrocer is the sequential descending bruteforcer which tries every possible password from the top down. The third bruteforcer is the randomized bruteforcer which tries every possible password combination in a random order.

Unfortunately, these bruteforcers do not work as well as I would like them to. There is a major bug present in each of them. All of these bruteforcers are based upon the twitcurl library which the bug lies therein. Basically, once the bruteforcer finds the correct password it doesnt stop bruteforcing because the twitcurl library does not correctly distinguish between failed and successful password login attempts. To combat this bug, I have the bruteforcer tweet if the login is after it logs in. If the tweet is made under the account being bruteforced, then you know that the bruteforcer has hit the correct password. I have each bruteforcer log all of the passwrods tried and the output returned from Twitter. So after you see your tweet made under the account being bruteforced, you should stop the bruteforcers and check the log to find out which was the successful password. Yes, it's extremely annoying, but at least it is possible to get the successful password without too much pain.

These were written in C++ using the twitcurl library. The source should be entirely cross-compatible so it should be able to be compiled on MAC, Linux, or Windows. I am only releasing Windows binaries in this post. The source to each of these bruteforcers will be released (this post will be updated with the links) in no more then 72 hours. I have no intention of making Linux or MAC binaries on my own but if anyone does let me know and I will add the links to them to this post.

Regarding the legality of these programs: These bruteforcers are NOT illegal. But they can be used illegally. Do NOT use them illegally. I do NOT support or condone using them to obtain passwords you do not have permission to get (which is again illegal).

Downloads:

Sequential Ascending Bruteforcer: Mediafire
Sequential Descending Bruteforcer: Mediafire
Randomized Bruteforcer: Mediafire


If you have any questions regarding the content of this post, feel free to leave a comment, join me in #arikadosblog on EFNET, post in our forums, tweet to me, or send me an e-mail at castlevania7689@yahoo.com

More Effective Bruteforcing

The goal of bruteforcing is ultimately to obtain a password via trying everyone possible until you tr the correct one. The main concern in any bruteforce attack is time. Thankfully, there a number of different modifications you can make to a bruteforcer to speed up the process. Please note that these methods are only effective on human created passwords. Passwords generated by a computer may become impossible to obtain if the suggestions in this post are followed.

Eliminate unlikely numbers

The most commonly used numbers in creating a password are the numbers 1 and 9. Unless you have reason to believe that the password you're attacking may contain other numbers, you will want to prevent your bruteforcer from checking any other numbers. Generally, people do not use all the numbers ( 0 - 9 ) available to them and sometimes don't even use any numbers at all. Getting rid of as many numbers as possible from being checked will greatly speed up your attack.

Eliminate unlikely letters

Most people do not use the letters z, x, or q in their passwords. You should prevent your bruteforcer from checking these and any other unlikely letters during your attack.

Attack from multiple directions

Figure out the sequentially greatest password your victim could possibly have. For example, if you believe that they do not have a password more then 8 characters long, then the greatest sequential password they could possibly have is zzzzzzzz. Have a descending sequential bruteforcer work from the top down.

Figure out the sequentially lowest password your victim could possibly have. For example, if you believe they could not possibly have a password less then 6 characters, then the sequentially lowest password is 000000. Have a second bruteforcer work as a sequential ascending bruteforcer from the bottom up.

Lastly, have as many bruteforcers as you can work as randomized bruteforcers and guess passwords between what you believe are the sequentially highest and lowest possible passwords.



Hopefully, the tips and tricks I've shared here will help you to more efficently and more quickly successfully bruteforce a password.

Writing a Randomized Bruteforce Attack in C/C++

The randomized bruteforce attack works by guessing possible passwords in a random order unlike the sequential bruteforce attacks which guesses passwords in a logical order.

Writing a randomized bruteforcer is very similar to writing a sequential bruteforcer. The only change in the attack is the password generation. For the password generation, in order to efficiently guess the password, you'll want to guess inside of a range character length. For example, if I was attacking someone, I would only try passwords between 6 and 8 characters in length since that is the average password size. Once you have the length decided upon and you have the location to attack specified, all thats left to do is generate and try passwords.

Below is a simple randomized bruteforce attack I wrote in C/C++:

 /*Change "(" to "<" and change ")" to ">" */
#include (iostream)
#include (string)
 
      using namespace std;
 
      /*Prototypes*/
      void checkPassword(string password);
    
      /*Globakl Variables*/
      char chars[]={'0','1','2','3','4','5','6','7','8','9','a','b','c','d','e','f','g','h','i','j','k','l','m','n','o','p','q','r','s','t','u','v','w','x','y','z'};
      string t;
 
      /*This function checks to see if the generated password is correct*/
      void checkPassword(string password) {
         
      cout << "Trying this password: " << password << endl;

      if (password==t) {
 
      cout << "match [" << password << "]" << endl;
    
      int pause;
      cin >> pause;
 
      exit(1);
 
      }
 
      }
    
      int main() {
 
      cout << "Enter a string (No more then 10 characters for demonstration purposes): " << endl;
 
      cin >> t;
 
      int passwordsize = t.length();
      string basestring = "";
 
      for(;;){
 

    /*Generate and then check the password*/
      for(int i=0;i
 
      int chooseachar = rand() % 35 + 0;
      basestring += chars[chooseachar];
 
      }
      checkPassword(basestring);
      basestring = "";
      }
 
      return 0;
 
      }

Really, this attack is much simpler then the sequential bruteforce attacks and should be very easy for everyone to understand. One quick note about it, for demonstration purposes, it only guesses passwords as long as the one you input.

Writing a Sequential Bruteforce Attack in C/C++

The bruteforce attack is simple enough to understand. It is performed by entering in every possible password that can be accepted by a system until the correct password is entered. However, actually writing one is a bit more complex. There's a complex underlying logic involved simply entering in every password. This post will cover the logic of programming a sequential bruteforcer and cap off with writing a sequential ascending bruteforcer in C/C++. Lastly, I will show a quick trick to turn the sequential ascending bruteforcer into a sequential descending bruteforcer.

A bruteforcer has three main logical components: A selection where the user inputs specific location of the attack; Generating the passwords to test; Testing the password.

Having the user input the specific location to attack is arguably the easiest part of writing a bruteforcer. This part can actually be "hard-coded" (specified by the programmer so no input is required) so I was thinking of not even mentioning it. But, I decided to bring it up as any bruteforcer meant to be used by more then one person will include this. Let's say we've written a bruteforcer that attacks Yahoo accounts. In this case, the bruteforcer will be programmed to attack Yahoo accounts, but the user must input the Yahoo account to specifically attack. This first component of the bruteforcer will handle thus handles obtianing this information.

Once the bruteforcer knows what it is going to attack, it must generate the password to try. In a sequential bruteforcer, the password tried each time will be sequentially one step away from the last password tried. So, in a sequential ascending bruteforcer, the bruteforcer will try the password 000001 followed by 000002. This works in reverse in a sequential descending bruteforcer. The programming of this is generally handled by writing a continuous loop which breaks only when the password generated is successful. Meanwhile, a handful of variables constantly increment with each run through the loop. When all of the possible passwords are tried, the variables are all reset as low as possible, the number of characters in the password is incremented or decremented, and the process begins again with checking all of the passwords one character longer or shorter then the last number of characters in a password. In practice, this is simpler then it sounds.

The last main component of a bruteforcer is the part in which a bruteforcer checks to see if it's generated the correct password. In some cases, this can surprisingly be the hardest part of the bruteforcer to write. Using our Yahoo example again, writing this part of the bruteforcer requires a knowledge of the Yahoo API. It's really hard for me to write how to perform the password check as each check will be written differently. While all checks are simple from a broad perspective, this is liable to get quite complex depending on what you're trying to bruteforce. My recommendation is to look for a library to do the check for you so you can do the least amount of work possible to perform what is really be a trivial step overall.

Here is the code I wrote to an ascending bruteforcer in C/C++. It's really rather small code and thus pretty self-explanatory. (The comments should help explain things too):

/*Change "(" to "<" and change ")" to ">" */
#include (iostream)
#include (string)
  
      using namespace std;
  
      /*Prototypes*/
      void checkPassword(string password);
      void recurse(int width, int position, string baseString);
     
      /*Global Variables*/
      char chars[]={'0','1','2','3','4','5','6','7','8','9','a','b','c','d','e','f','g','h','i','j','k','l','m','n','o','p','q','r','s','t','u','v','w','x','y','z'};
      string t;
 
      /*This function generates the password*/
      void recurse(int width, int position, string baseString) {
 
      for(int i=0;i<35;i++) {
 
      if (position < width-1) {
 
      recurse(width, position + 1, baseString+chars[i]);
 
      }
 
      checkPassword(baseString+chars[i]);
 
      }
 
      }
 
      /*This function checks to see if the generated password is correct*/
      void checkPassword(string password) {
          
      cout << "Trying this password: " << password << endl;

      if (password==t) {
 
      cout << "match [" << password << "]" << endl;
     
      int pause;
      cin >> pause;
 
      exit(1);
 
      }
 
      }
     
      int main() {
  
      cout << "Enter a string (No more then 10 characters for demonstration purposes): " << endl;
 
      cin >> t;
 
      int maxChars = 10;
 
      for(int i=1;i

      cout << "Checking passwords width [" << i << "]..." << endl;
 
      recurse(i,0,"");
 
      }
 
      return 0;
 
      }

To turn this into a sequential descending brutefrocer, make two small changes. Change the chars[] to equal: {'z','y','x','w','v','u','t','s','r','q','p','o','n','m','l','k','j','i','h','g','f','e','d','c','b','a','9','8','7','6','5','4','3','2','1','0'};
And lastly change the for loop in main() to:
for(int i = maxChars; i >0; i++) {

For those of you who still might not fully understand how all of the C/C++ works, I strongly encourage you to compile the bruteforcer program to further your study. I hope all of you reading this have found the subject of bruteforcers to be as fascinating as I find them to be.

The Bruteforce Attack

In computers and computer security, the one thing protecting data is the computer password. And where there are passwords, there are people who want access to whatever it is they protect. One of the most popular methods used to obtain a computer password is the bruteforce attack. This post will thoroughly explain what the bruteforce attack is and how to defend your computer security system from it.

Aside from guessing a password, the bruteforce attack is the most popular method used to uncover a password. The bruteforce attack is performed by simply testing every single possible password. By doing so, the correct password is bound to be discovered eventually.

The problem with the bruteforce attack is the impractical amount of time it takes to find the correct password. If the password you attempt to crack is rather large, it can take nearly a century to try every possible password combination until you try the correct one. The solution is to bruteforce the password in different directions. Thus, for a hacker to successfully uncover a password through a bruteforce attack in a significantly shorter amount of time, he would have to have run one bruteforcer program trying every password in a sequential ascending order from the first possible password; Run a second bruteforcer program trying every password in a descending sequential order from the last possible password; And lastly run as many bruteforcer programs as possible which randomly try password combinations in between the sequentially first and last possible password. Hopefully, a hacker can then uncover a password in more decent amount of time (But it is still probably going to be a very long amount of time overall).

A subsidiary of the bruteforce attack that I feel inclined to mention is the dictionary attack. The dictionary attack takes a list of words which the hacker believes are liable to be part of the password being attacked. The dictionary attack program uses an algorithm to test each word individually, each word with numbers inserted on the ends of the word, and combinations of putting words together, and putting numbers on the end of word combinations. Dictionary attacks are generally hit-or-miss when compared to the generic style of a bruteforce attack performed by hacker as described in the paragraph above this one. Also as described in the paragraph above, the solution to more quickly obtaining a password via bruteforcing is to run as many bruteforcers as possible; In this case, running as many different dictionary lists to attack passwords with at once as possible.

Defending your computer security system from bruteforce attacks is really pretty simple. The easiest method is to make passwords case sensitive. Just by doing this, you can take the time it takes to successfully bruteforce a password and raise that to a power of 26 (this does not hold true between varying units of time). The second way to defend against bruteforce attacks is to only let a user incorrectly enter in a password 5 times a day. Since it usually takes thousands of failed passwords before successfully uncovering a passwords, this simple addition to your security system renders bruteforcing useless. Thirdly, you should require your users to have passwords that are at least eight characters in length. And lastly, you should encourage your users to change their password once a year.

All together, the bruteforce attack actually isn't as great as people make it sound like it is. Yes, it has infamously cracked some important passwords, but overall, you're better off practicing Kevin Mitnick's Art of Deception (AKA Social Engineering) to crack a password.

Coding Section

This post is an archive documenting all posts related to coding or computer programming.

General Programming Tutorials

• How to set-up and SVN on Googlecode and how to use Tortoise
  

C++ Tutorials

• What are C and C++?
• Setting up for C++
• Analysis of the Hello World program
• Comments with C++
• Variables with C++
• C++ Keyword: typedef
• The least you need to know about scopes with C++
• C++ Keyword: using and a little on Namespaces
• if ... then statements with C/C++
• Writing a sequential bruteforce attack in C/C++
• Writing a randomized bruteforce attack in C/C++
  

Wii Homebrew Development

• How to play external MP3 files with libogc's MP3Player
• How to output text from fonts with libwiisprite
• How to program with the balance board
  

My developments tools

• My ALLEGRO Sprite Class
• gl2gx Compilation
• libwiisprite devkitPROr19 recompilation
  

Insight

• Why I'm developing with ALLEGRO
• The bruteforce attack  
  
• More effective bruteforcing
  

Editorial

• Why Windows is the best target development platform for computers

Special: Porting DeSmuME to Wii

• Part 1
• Part 2
• Part 3
• Part 4
• Part 5