Brutus - Authentication Engine Test Release 2 www.hoobie.net/brutus

28th January 2000

Changes in release AET2 :

1 – All user specified server response strings are converted to lowercase now as are the actual server responses.
2 – Fixed the problem encountered whilst trying to change the timeout during operation.
3 – Fixed problem with the default POP3 settings (related to fix 1 above.)
4 – Added brute force password generation
5 – Added save current session
6 – Added auto-save current session
7 – Added restore saved session
8 – Added save custom service
9 – Added load custom service
10 – Added password permutations
11 – Added word list creation functions
12 – Fixed update problems in the Auth. Seq. Definition window
13 – Added pause/resume functions
14 – Added semi-automatic 'learn' function for HTML form/CGI based services
15 – Added skip user on multiple password prompt failures
16 – Added 'use updated form fields' option to HTML form based services to enable attacks against services which use one time values in HTML form fields.
17 – Created a few example services, Netbus, IMAP, Cisc0 console, Cisc0 enable etc….only tested NetBus.
18 – Completed the 'view authentication sequence' display.
19 - Added SMB authentication for Windows and Samba servers (Only uses API at the moment so is very sloow)

What does it do?

This component of Brutus is capable of authenticating against a wide range of character based application protocols. This is used to facilitate dictionary based user/password attacks against various network applications. This release comes with the following built-in network applications :

HTTP - Basic authentication HTTP - CGI application authentication (typically used with HTML forms) FTP POP3 Telnet

There is also a custom facility which allows you to create your own authentication sequences tailored to your target in addition to being able to modify the built in applications. Using the custom facilty