Re: Using smbbf

[Base64 <base640 () gmail com>]

smbbf simply does not support a incrementing brute-force mode.  A
brute force password attack on network services is very unfeasable,
even on a LAN it would take years to bruteforce an 8 character
password.

  Anyhow, there is a way to do what you ask, and it is very easy. 
Just take a tool like access driver or raptor (both win32) to create a
wordlist that consists of all possible combinations, then feed this
"wordlist" to smbbf, and go drink a cup of coffee, about 10 years
worth.

 -base64

On 9/28/05, dissolved () comcast net <dissolved () comcast net> wrote:
> Hi, I'm trying to password audit a windows 2000 machine across the network.
> I'm using smbbf to do this (windows version).  Here is the issue I am having:
>
> The syntax I'm using is:
>
> Smbbf -i 192.168.2.10 -u userlist.txt -p passwords.txt -v
>
> This appears to do a dictionary attack, when I really wanted to do a brute
> force. I already know the passwords on the target machine, and they are not
> dictionary words.
>
> Is there a way to make smbbf use every keystroke, instead of reading from a
> password file like I have done above? If not, can someone recommend a free tool
> that can accomplish this?
>
> Thanks
> dissolved
>
> ------------------------------------------------------------------------------
> Audit your website security with Acunetix Web Vulnerability Scanner:
>
> Hackers are concentrating their efforts on attacking applications on your
> website. Up to 75% of cyber attacks are launched on shopping carts, forms,
> login pages, dynamic content etc. Firewalls, SSL and locked-down servers are
> futile against web application hacking. Check your website for vulnerabilities
> to SQL injection, Cross site scripting and other web attacks before hackers do!
> Download Trial at:
>
> http://www.securityfocus.com/sponsor/pen-test_050831
> -------------------------------------------------------------------------------

------------------------------------------------------------------------------
Audit your website security with Acunetix Web Vulnerability Scanner:

Hackers are concentrating their efforts on attacking applications on your
website. Up to 75% of cyber attacks are launched on shopping carts, forms,
login pages, dynamic content etc. Firewalls, SSL and locked-down servers are
futile against web application hacking. Check your website for vulnerabilities
to SQL injection, Cross site scripting and other web attacks before hackers do!
Download Trial at:

http://www.securityfocus.com/sponsor/pen-test_050831
-------------------------------------------------------------------------------