bruteforcing a password

[koetje]

Hi i am new and a complete beginner in AutoIT and programming.

I am currently using a program which i forgot the password for it was a password with 4 numbers. It's an accounting software and the programmer stopped giving support. I know it's stupid to forget the password for something really important. So here's the deal i trying to bruteforce it.

Until now i have this.

1 run("F:\SoftwareFactory\Restaurant-Takeaway\SF.exe")

2 WinWaitActive("Login")

3 Sleep(2000)

4 $nummer =

5 Send("$numner")

6 Send("{ENTER}")

7 Sleep(5000)

8 Send("{ENTER}")

The program needs to send numbers 1 to 9999 , one by one , so bruteforcing it. Any help?

[MonsieurOUXX]

First, be careful, you misspelled $nummer (you wrote $numner).

Also, you must not do this :

Send("$nummer")

(otherwise it's like you type the string "$nummer" into the login window, instead of copying the value contained by the $nummer variable)

Instead, the correct instruction should be :

Send($nummer)

(without the quotes)

===

I'm not sure if the login window will set the focus directly to the password field ("Send" will be enough) or if your first need to set the focus to the password field. The script below doesn't set the focus to the password field.

===

The value of $nummer can be generated by a loop, incrementing $nummer at every iteration.

for example:

run("F:\SoftwareFactory\Restaurant-Takeaway\SF.exe")
WinWaitActive("Login")
Sleep(2000) ;not sure why you need to wait 2 seconds here
 
 
$nummer=0
while $nummer < 10000 ;loop until we reach 9999
   Send($nummer)
   Send("{ENTER}")
   Sleep(1000) ;adjust the time needed between each attempt
   $nummer = $nummer+1
wend

See the comments in the code abive.

Also please note that my script will type numbers between 0 and 999 without the zeros in front of them. I'm not sure if you need "83" to be entered as "0083"

Edited October 27, 2011 by MonsieurOUXX

[sleepydvdr]

If you need the number to be formatted with zeros like MonsieurOUXX mentioned, then change:

Send($nummer)

To:

$formattedNumber = StringFormat("%04d", $number)
Send($formattedNumber)

[bogQ]

Reported

Edit: i really can't believe that there are some people who dont understand that this forum isnt for illegal things. I can understand it from someone who have 60 posts, from someone who is here 3 years and have 400+ posts i realy cant. shame on you.

Edited October 27, 2011 by bogQ

[MonsieurOUXX]

Woops, you're totally right.

Sorry, I didn't know there were such rules on the forum.

I had no way to now if this is illegal. Indeed, if that person owns the license to that software and if he owns the data, as he said, and if the ULA of that (old) accountancy application doesn't mention automated logging, then it's not illegal.

Having said that, I understand what you said and I apologize for having broken the forum's rules. Sorry again.

Edited October 27, 2011 by MonsieurOUXX

[Manko]

You should always be weary when a firstposter asks for shady things, nomater how good his reasons/arguments/stories are...

/Manko

[EDIT: is plural are...]

Edited October 27, 2011 by Manko

[Blue_Drache]

Woops, you're totally right.

Sorry, I didn't know there were such rules on the forum.

Suggestion... remove your reply. It will look better if you remove it before a mod does.

[sleepydvdr]

Reported

Edit: i really can't believe that there are some people who dont understand that this forum isnt for illegal things. I can understand it from someone who have 60 posts, from someone who is here 3 years and have 400+ posts i realy cant. shame on you.

I don't see anything in the rules against making a bruteforce password cracker. Please show me where it says that.

[kaotkbliss]

I don't see anything in the rules against making a bruteforce password cracker. Please show me where it says that.

I believe it falls under this

• Breaking CAPTCHA's, by-passing anti-bot measures or other methods for by-passing software activation.

[sleepydvdr]

It's not to bypass software activation. Bypassing software activation is not entering a serial number or fooling the software that it got activation confirmation from the internet. He was not trying to do any of that.

This person's software password cracking is to crack his own password so he can use his software.

[JohnOne]

How certain are you that every script weasel who cares to look, wont take this innocent password forcing script and use it

to aid their own dastardly deeds?

Its common sense, I'm sure you realize that.

[sleepydvdr]

How certain are you that every script weasel who cares to look, wont take this innocent password forcing script and use it

to aid their own dastardly deeds?

Its common sense, I'm sure you realize that.

Well, when the mods read this thread and if they deem password crackers to be off limits, I suggest they update the forum rules to specify that. As it stands, there is nothing in the rules against password crackers.

[nitekram]

So now the rules will have to be updated, so that we can point to the fact that this is not what we want to have people using AutoIt for.

[kaotkbliss]

Not wanting to drag this out any longer, but

It does in fact CLEARLY fall into what I bolded.

Reguardless of whether the software was purchased or not

It requires a password to be started/activated

Using a brute force cracker to bypass that, bypasses the activation/startup security of the program and thus:

is a method for by-passing software activation.

[JohnOne]

Well, when the mods read this thread and if they deem password crackers to be off limits, I suggest they update the forum rules to specify that. As it stands, there is nothing in the rules against password crackers.

Suggest away.

As far as I'm concerned I don't need every single possible thing that might be stupid or against the rules spelling out.

Clearly others do.

Good luck with that.

[GEOSoft]

It definitely falls under the area where we don't want to see AutoIt used for any potentially malicious or unethical purposes.

We really do support sustaining a good reputation for AutoIt.

[Valik]

I don't see anything in the rules against making a bruteforce password cracker. Please show me where it says that.

I want you to think real hard about the rules. In fact, I want you to think about it for 3 days because you are banned from this forum. If you'd like to debate further by PM I'd be more than happy to permanently remove you from this forum. For the rest of you who aren't idiots, this falls under "malware".

This thread is locked. Several of you need to re-vist the rules.