Good IIS / ASP.NET Dictionary or Force Attack Software

Question

I am looking for something that uses the IIS / ASP.NET website, which uses forms authentication and tries repeatedly to log in with all possible passwords or passwords from the dictionary.

I probably can write something, but I wondered if there was something publicly available that would be better implemented.

Answer 1

For online forced entry systems, I recommend using THC-Hydra . I always use this tool in my penetration tests. In contrast, if you have a password hash or salted password hash lists, you should use John The Ripper to disable it offline, which is much faster.

After 3 unsuccessful logins, you must specify this IP address using captcha, for example reCaptcha .

Answer 2

ASP.NET, passwordAttemptThreshold. . , , passwordAttemptThreshold, . , , .

, , . , , , , , , , , .

Answer 3

Instead of attacking the site from the outside, I would recommend using hashes and cracking them offline.

The best approach is to create a password policy on the site, so you do not need to do this. In most cases, cracking passwords is tough and unnecessary.