Re: Pentesting a Web Applicaton

[Eric Smith <defcon47 () yahoo com>]

Why not just reset the router? In the amount of time you would waste to brute force or dictionary attack it, you could 
reset, reconfig and be back up and running in minutes.

----- Original Message ----
From: "Stong, Ian C CTR DISA GIG-CS" <Ian.Stong.ctr () disa mil>
To: PenTest <pen-test () securityfocus com>
Sent: Thursday, May 31, 2007 12:29:33 PM
Subject: Pentesting a Web Applicaton

Hi,

I have a DLINK router/wireless device that has a web interface for
managing it via the inside interface. I know the username but the
password was cached and due to some Winblows issues the info is gone. 

Would like some advice for tools I can run (on Windows) to attempt to
find the password. I tried brutus but wasn't able to get it to work
properly (or I misconfigured).  

When you access the router via web interface a popup comes up asking for
username/pwd. It says "Enter username and password for "DI-514" at
y.y.y.y - Then it has fields for User Name: and Password: - and then OK
or Cancel.


You help is appreciated,

Ian Stong

------------------------------------------------------------------------
This List Sponsored by: Cenzic

Are you using SPI, Watchfire or WhiteHat?
Consider getting clear vision with Cenzic
See HOW Now with our 20/20 program!

http://www.cenzic.com/c/2020
------------------------------------------------------------------------






      ___________________________________________________________________________________
You snooze, you lose. Get messages ASAP with AutoCheck
in the all-new Yahoo! Mail Beta.
http://advision.webevents.yahoo.com/mailbeta/newmail_html.html

------------------------------------------------------------------------
This List Sponsored by: Cenzic

Are you using SPI, Watchfire or WhiteHat?
Consider getting clear vision with Cenzic
See HOW Now with our 20/20 program!

http://www.cenzic.com/c/2020
------------------------------------------------------------------------