looking for a webapp bruteforce video for non-techies

[Robin Wood-2]

Hi
Can anyone recommend a video showing how easy it can be to brute force
a web application that I can show to non-technical people. I want
something quick and polite - preferably no leet speak banners or that
type of thing - that I can show to both board level people and just
generally to friends and family who chose bad passwords for web
applications.

I've just been with a client who, after being told a dictionary word
was bad, just put a 3 in instead of an e and thought she was
completely secure. It didn't help that the password was only 5
characters!

Thanks

Robin

-------------------------------------------------------------------------
Sponsored by: Watchfire
Methodologies & Tools for Web Application Security Assessment
With the rapid rise in the number and types of security threats, web application security assessments should be considered a crucial phase in the development of any web application. What methodology should be followed? What tools can accelerate the assessment process? Download this Whitepaper today!

https://www.watchfire.com/securearea/whitepapers.aspx?id=70170000000940F
-------------------------------------------------------------------------

[Jakub-10]

Hey there,
i know this is not what you asked for but if you gonna use such vido
for your own purposes
then maybe making one on your own would be a good idea?
you could focus on things that really matters for you i guess

if i could be any help about tools to use or whatever feel free to contact me :)

cheers
J.

2008/6/3 Robin Wood <dninja@...>:

> Hi
> Can anyone recommend a video showing how easy it can be to brute force
> a web application that I can show to non-technical people. I want
> something quick and polite - preferably no leet speak banners or that
> type of thing - that I can show to both board level people and just
> generally to friends and family who chose bad passwords for web
> applications.
>
> I've just been with a client who, after being told a dictionary word
> was bad, just put a 3 in instead of an e and thought she was
> completely secure. It didn't help that the password was only 5
> characters!
>
> Thanks
>
> Robin
>
> -------------------------------------------------------------------------
> Sponsored by: Watchfire
> Methodologies & Tools for Web Application Security Assessment
> With the rapid rise in the number and types of security threats, web application security assessments should be considered a crucial phase in the development of any web application. What methodology should be followed? What tools can accelerate the assessment process? Download this Whitepaper today!
>
> https://www.watchfire.com/securearea/whitepapers.aspx?id=70170000000940F
> -------------------------------------------------------------------------
>
>

-------------------------------------------------------------------------
Sponsored by: Watchfire
Methodologies & Tools for Web Application Security Assessment
With the rapid rise in the number and types of security threats, web application security assessments should be considered a crucial phase in the development of any web application. What methodology should be followed? What tools can accelerate the assessment process? Download this Whitepaper today!

https://www.watchfire.com/securearea/whitepapers.aspx?id=70170000000940F
-------------------------------------------------------------------------

[Martin O'Neal]

> It didn't help that the password was only 5
> characters!

That may not actually be such a bad password (on balance and in
context).  Sure it is a dictionary/leet word variant, but five
characters actually carry plenty of entropy (if mixed case and numerics
are also used).  However, if you have an authentication mechanism that
doesn't lock out an account and *allows* brute forcing, it doesn't
really matter how strong the password is; given enough
universe-lifetimes an attacker will always guess it eventually.

Choose your battle wisely.  Choose to fight the broken auth.

Martin...

PS I don't have a brute forcing clip, but I do have a video of my
cousin's dog catching a frisbee if you're interested


-------------------------------------------------------------------------
Sponsored by: Watchfire
Methodologies & Tools for Web Application Security Assessment
With the rapid rise in the number and types of security threats, web application security assessments should be considered a crucial phase in the development of any web application. What methodology should be followed? What tools can accelerate the assessment process? Download this Whitepaper today!

https://www.watchfire.com/securearea/whitepapers.aspx?id=70170000000940F
-------------------------------------------------------------------------

[Robin Wood-2]

2008/6/3 Martin O'Neal <martin.oneal@...>:

>
>> It didn't help that the password was only 5
>> characters!
>
> That may not actually be such a bad password (on balance and in
> context).  Sure it is a dictionary/leet word variant, but five
> characters actually carry plenty of entropy (if mixed case and numerics
> are also used).  However, if you have an authentication mechanism that
> doesn't lock out an account and *allows* brute forcing, it doesn't
> really matter how strong the password is; given enough
> universe-lifetimes an attacker will always guess it eventually.

Trust me, it is a VERY bad password in these circumstances!

Robin

-------------------------------------------------------------------------
Sponsored by: Watchfire
Methodologies & Tools for Web Application Security Assessment
With the rapid rise in the number and types of security threats, web application security assessments should be considered a crucial phase in the development of any web application. What methodology should be followed? What tools can accelerate the assessment process? Download this Whitepaper today!

https://www.watchfire.com/securearea/whitepapers.aspx?id=70170000000940F
-------------------------------------------------------------------------

[pand0ra]

Irongeek.com

http://www.irongeek.com/i.php?page=security/hackingillustrated

On Tue, Jun 3, 2008 at 7:42 AM, Robin Wood <dninja@...> wrote:

> Hi
> Can anyone recommend a video showing how easy it can be to brute force
> a web application that I can show to non-technical people. I want
> something quick and polite - preferably no leet speak banners or that
> type of thing - that I can show to both board level people and just
> generally to friends and family who chose bad passwords for web
> applications.
>
> I've just been with a client who, after being told a dictionary word
> was bad, just put a 3 in instead of an e and thought she was
> completely secure. It didn't help that the password was only 5
> characters!
>
> Thanks
>
> Robin
>
> -------------------------------------------------------------------------
> Sponsored by: Watchfire
> Methodologies & Tools for Web Application Security Assessment
> With the rapid rise in the number and types of security threats, web application security assessments should be considered a crucial phase in the development of any web application. What methodology should be followed? What tools can accelerate the assessment process? Download this Whitepaper today!
>
> https://www.watchfire.com/securearea/whitepapers.aspx?id=70170000000940F
> -------------------------------------------------------------------------
>
>

-------------------------------------------------------------------------
Sponsored by: Watchfire
Methodologies & Tools for Web Application Security Assessment
With the rapid rise in the number and types of security threats, web application security assessments should be considered a crucial phase in the development of any web application. What methodology should be followed? What tools can accelerate the assessment process? Download this Whitepaper today!

https://www.watchfire.com/securearea/whitepapers.aspx?id=70170000000940F
-------------------------------------------------------------------------

[admin-252]

> -------- Original Message --------
> Subject: RE: looking for a webapp bruteforce video for
> non-techies
> From: "Martin O'Neal" <martin.oneal@...>
> Date: Tue, June 03, 2008 5:01 pm
> To: "Robin Wood" <dninja@...>,  <webappsec@...>,
> "pen-test" <pen-test@...>
>
> > It didn't help that the password was only 5
> > characters!
>
> That may not actually be such a bad password (on balance and in
> context).  Sure it is a dictionary/leet word variant, but five
> characters actually carry plenty of entropy (if mixed case and numerics
> are also used).  However, if you have an authentication mechanism that
> doesn't lock out an account and *allows* brute forcing, it doesn't
> really matter how strong the password is; given enough
> universe-lifetimes an attacker will always guess it eventually.

I saw one setup where I could recover three quarters (about four thousand) of one set of passwords on a Celeron 2GHz in under an hour. Another set of passwords were forced to 4-digits (insane, I know), and due to the number of users, each would share his/her password with about 4 other people.

The point is here, you wouldn't necessarily break any per-user lockout limits, because you could take thirty minutes looping over the entire userbase with the same password, then start again and still get a good number of cracks.

So, definitely depends on the size of your userbase and whether they can be effectively enumerated. Even so, I wouldn't regard any dictionary word with one character tweaked as secure these days.

cheers,

--
www.systemstates.net - penetration test / IDS / incident response



-------------------------------------------------------------------------
Sponsored by: Watchfire
Methodologies & Tools for Web Application Security Assessment
With the rapid rise in the number and types of security threats, web application security assessments should be considered a crucial phase in the development of any web application. What methodology should be followed? What tools can accelerate the assessment process? Download this Whitepaper today!

https://www.watchfire.com/securearea/whitepapers.aspx?id=70170000000940F
-------------------------------------------------------------------------

[Paul Melson-2]

> That may not actually be such a bad password (on balance and in
> context).  Sure it is a dictionary/leet word variant, but five
> characters actually carry plenty of entropy (if mixed case and numerics
> are also used).  However, if you have an authentication mechanism that
> doesn't lock out an account and *allows* brute forcing, it doesn't
> really matter how strong the password is; given enough
> universe-lifetimes an attacker will always guess it eventually.

I second Martin's comment.  There's no point in talking to users about
password selection if the application doesn't A) lock the account after X
number of failed attempts *AND* B) force password expiration/rotation.
There's a very basic mathematical formula found in the Department of Defense
Password Management Guideline[1] that can be used to calculate the risk
associated with any particular password policy versus brute force guessing.
Definitely required reading for anyone designing or specifying a password
authentication mechanism.


PaulM

[1] http://www.fas.org/irp/nsa/rainbow/std002.htm


-------------------------------------------------------------------------
Sponsored by: Watchfire
Methodologies & Tools for Web Application Security Assessment
With the rapid rise in the number and types of security threats, web application security assessments should be considered a crucial phase in the development of any web application. What methodology should be followed? What tools can accelerate the assessment process? Download this Whitepaper today!

https://www.watchfire.com/securearea/whitepapers.aspx?id=70170000000940F
-------------------------------------------------------------------------

[Robin Wood-2]

2008/6/3 Paul Melson <pmelson@...>:

>> That may not actually be such a bad password (on balance and in
>> context).  Sure it is a dictionary/leet word variant, but five
>> characters actually carry plenty of entropy (if mixed case and numerics
>> are also used).  However, if you have an authentication mechanism that
>> doesn't lock out an account and *allows* brute forcing, it doesn't
>> really matter how strong the password is; given enough
>> universe-lifetimes an attacker will always guess it eventually.
>
> I second Martin's comment.  There's no point in talking to users about
> password selection if the application doesn't A) lock the account after X
> number of failed attempts *AND* B) force password expiration/rotation.
> There's a very basic mathematical formula found in the Department of Defense
> Password Management Guideline[1] that can be used to calculate the risk
> associated with any particular password policy versus brute force guessing.
> Definitely required reading for anyone designing or specifying a password
> authentication mechanism.
>

Let me restate the question:

I have a client who uses the same, really easy, really guessable
password for all the sites he visits. It is a 5 letter word with one
character changed to a numeric, if you know his name, you'll probably
guess his password within a couple of attempts.

I've explained the problem with this to him and I've preached as much
as I can. I know all about secure passwords, entropy and stuff like
that but all I want is a couple of minute video that shows someone
launching something like hydra, setting it up by clicking a few
buttons, clicking go then a few minutes later a password pops out
somewhere.

All I'm after is the viewer sitting back and going "wow, is it that
easy to break my password" then going through and changing it to
something a more secure.

So, I'm not after advice on how to build a secure login system, just a
video to scare users with.

Robin

-------------------------------------------------------------------------
Sponsored by: Watchfire
Methodologies & Tools for Web Application Security Assessment
With the rapid rise in the number and types of security threats, web application security assessments should be considered a crucial phase in the development of any web application. What methodology should be followed? What tools can accelerate the assessment process? Download this Whitepaper today!

https://www.watchfire.com/securearea/whitepapers.aspx?id=70170000000940F
-------------------------------------------------------------------------

[Dan Walker-4]

On the subject of videos you can find some good ones here:

http://www.educause.edu/SecurityVideoContest2006/7103

or the 2007 contest:

http://www.educause.edu/SecurityVideoContest2007/13549


Dan

On Tue, Jun 3, 2008 at 7:56 AM, Jakub <evaver@...> wrote:

> Hey there,
> i know this is not what you asked for but if you gonna use such vido
> for your own purposes
> then maybe making one on your own would be a good idea?
> you could focus on things that really matters for you i guess
>
> if i could be any help about tools to use or whatever feel free to contact me :)
>
> cheers
> J.
>
> 2008/6/3 Robin Wood <dninja@...>:
>> Hi
>> Can anyone recommend a video showing how easy it can be to brute force
>> a web application that I can show to non-technical people. I want
>> something quick and polite - preferably no leet speak banners or that
>> type of thing - that I can show to both board level people and just
>> generally to friends and family who chose bad passwords for web
>> applications.
>>
>> I've just been with a client who, after being told a dictionary word
>> was bad, just put a 3 in instead of an e and thought she was
>> completely secure. It didn't help that the password was only 5
>> characters!
>>
>> Thanks
>>
>> Robin
>>
>> -------------------------------------------------------------------------
>> Sponsored by: Watchfire
>> Methodologies & Tools for Web Application Security Assessment
>> With the rapid rise in the number and types of security threats, web application security assessments should be considered a crucial phase in the development of any web application. What methodology should be followed? What tools can accelerate the assessment process? Download this Whitepaper today!
>>
>> https://www.watchfire.com/securearea/whitepapers.aspx?id=70170000000940F
>> -------------------------------------------------------------------------
>>
>>
>
> -------------------------------------------------------------------------
> Sponsored by: Watchfire
> Methodologies & Tools for Web Application Security Assessment
> With the rapid rise in the number and types of security threats, web application security assessments should be considered a crucial phase in the development of any web application. What methodology should be followed? What tools can accelerate the assessment process? Download this Whitepaper today!
>
> https://www.watchfire.com/securearea/whitepapers.aspx?id=70170000000940F
> -------------------------------------------------------------------------
>
>

-------------------------------------------------------------------------
Sponsored by: Watchfire
Methodologies & Tools for Web Application Security Assessment
With the rapid rise in the number and types of security threats, web application security assessments should be considered a crucial phase in the development of any web application. What methodology should be followed? What tools can accelerate the assessment process? Download this Whitepaper today!

https://www.watchfire.com/securearea/whitepapers.aspx?id=70170000000940F
-------------------------------------------------------------------------

[Anthony Cicalla-3]

http://youtube.com/watch?v=fEGFovLwz9w
One brutus demo, there are more just pull this up. Start going to
youtube and look for demo's there are lots on the site.

Anthony
On 6/3/08, Robin Wood <dninja@...> wrote:

> Hi
> Can anyone recommend a video showing how easy it can be to brute force
> a web application that I can show to non-technical people. I want
> something quick and polite - preferably no leet speak banners or that
> type of thing - that I can show to both board level people and just
> generally to friends and family who chose bad passwords for web
> applications.
>
> I've just been with a client who, after being told a dictionary word
> was bad, just put a 3 in instead of an e and thought she was
> completely secure. It didn't help that the password was only 5
> characters!
>
> Thanks
>
> Robin
>
> -------------------------------------------------------------------------
> Sponsored by: Watchfire
> Methodologies & Tools for Web Application Security Assessment
> With the rapid rise in the number and types of security threats, web application security assessments should be considered a crucial phase in the development of any web application. What methodology should be followed? What tools can accelerate the assessment process? Download this Whitepaper today!
>
> https://www.watchfire.com/securearea/whitepapers.aspx?id=70170000000940F
> -------------------------------------------------------------------------
>
>

--
Anthony,
CNA,CEH,CISSP,GSNA,MCP,SCTA
925-262-7565

-------------------------------------------------------------------------
Sponsored by: Watchfire
Methodologies & Tools for Web Application Security Assessment
With the rapid rise in the number and types of security threats, web application security assessments should be considered a crucial phase in the development of any web application. What methodology should be followed? What tools can accelerate the assessment process? Download this Whitepaper today!

https://www.watchfire.com/securearea/whitepapers.aspx?id=70170000000940F
-------------------------------------------------------------------------

[Anthony Cicalla-3]

http://youtube.com/results?search=related&search_query=Brute%20Force%20Hack%20Brutus%20hacking%20cracking&v=fEGFovLwz9w

Here there are 26 video's on password cracking and the fact that they
are up on youtube for the world to see might add the the impact that
your trying to create.

anthony

On 6/3/08, Robin Wood <dninja@...> wrote:

> Hi
> Can anyone recommend a video showing how easy it can be to brute force
> a web application that I can show to non-technical people. I want
> something quick and polite - preferably no leet speak banners or that
> type of thing - that I can show to both board level people and just
> generally to friends and family who chose bad passwords for web
> applications.
>
> I've just been with a client who, after being told a dictionary word
> was bad, just put a 3 in instead of an e and thought she was
> completely secure. It didn't help that the password was only 5
> characters!
>
> Thanks
>
> Robin
>
> -------------------------------------------------------------------------
> Sponsored by: Watchfire
> Methodologies & Tools for Web Application Security Assessment
> With the rapid rise in the number and types of security threats, web application security assessments should be considered a crucial phase in the development of any web application. What methodology should be followed? What tools can accelerate the assessment process? Download this Whitepaper today!
>
> https://www.watchfire.com/securearea/whitepapers.aspx?id=70170000000940F
> -------------------------------------------------------------------------
>
>

--
Anthony,
CNA,CEH,CISSP,GSNA,MCP,SCTA
925-262-7565

-------------------------------------------------------------------------
Sponsored by: Watchfire
Methodologies & Tools for Web Application Security Assessment
With the rapid rise in the number and types of security threats, web application security assessments should be considered a crucial phase in the development of any web application. What methodology should be followed? What tools can accelerate the assessment process? Download this Whitepaper today!

https://www.watchfire.com/securearea/whitepapers.aspx?id=70170000000940F
-------------------------------------------------------------------------