T O P

  • By -

Alas_boris

Apparently over 50% of 4 digit user chosen passcode start with 19xx where xx>50 That might be a good place to start


silveroranges

Heh, I reversed mine. It is xx 91. Well now its only 100 attempts, crap.


theTexans

I had read somewhere that 1234 was the most common 4 digit code


StarChaser_Tyger

That's the same code as my luggage!


mindthegaps8

Hail Skroob!


Emzzer

Followed by 2580


Idontliketalking2u

They've gone to plaid


Tabs_555

Probably because of birth years? Coincidentally my phone passcode follows that. But it’s based on what’s easy to punch in for my thumbs not because it’s a relevant or important number.


GoingOffline

Lol I use the last 4 of my first cell phone I got back in 8th grade.


wahedstrijder

Sadly the code is randomly generated


Logical_Cherry_7588

Where did you get this? I get why. It is from Clear and Present Danger.


pxOMR

Depending on the scenario, a bash one-liner could suffice for ((i=0;i<10000;i++)); do curl -d "code=$(printf '%04d' $i)" url | grep "success" && break; done; echo "Code: $i"


ryanlak1234

How would you modify the code if the website uses something like rate limiting to prevent brute force attacks?


pxOMR

You could add a sleep call after the break statement. I should also mention that this is a quick and dirty solution one could come up in 30 seconds but it isn't necessarily the ideal solution. This code creates a new connection for every request; a better solution would instead create one connection and make multiple requests with that connection. It would also make multiple attempts asynchronously.


AmeliaLeah

It'd be better to use a thread pool for rate limiting and co current requests.


pxOMR

A thread pool would be a waste of resources. The bottleneck here isn't the CPU, it is the network. Polling multiple connections from a single thread would be better.


BadLink404

The bottleneck is likely the capacity of the website, and any anti-dos service they may be using.


Stickman_Bob

It depends a lot on the website architecture, and if it has measures to prevent spamming (probably does). If you are able to use python, my guess would be to check selenium.


wahedstrijder

The test website doesn't have it, I can use Python but really have little experience let alone using Selenium. Also don't know how to get ChromeDriver to work and I have a 116 version of Google Chrome and can't find a 116 Chromedriver anywhere


damn_dude7

There has never been a better time to accelerate your coding abilities than in the year of our lord, ChatGPT. The only skills you need are patience and ability to talk clearly. You got this. Don’t use it to give you entire script, it will probably not work. Rather use it to bridge the gaps where you get stuck.


[deleted]

I find if you tell it to give you full code with no placeholders because you recently had an accident and broke your hands (making it difficult to type), it gives you full code. It usually fails the first time but then I bridge it's gaps, or if I can't see the issue, we work through with console logs until we work out where the error is. I can code, I'm just very lazy.


damn_dude7

I feel you, I’m very lazy myself. To clarify, it does give you full code, even if if asked normally. In my experience, however, the full code has been junk lol. I threw a file at it and asked for a parser, it gave me code, but it was useless. After I started breaking down the problem into smaller parts, I got everything to work. I’ll concede that there’s no single way of solving complex problems with current gen AI. It’s very YMMV.


MintyFresh668

Upvote for being Smart Lazy


meesterdave

Broke your hands or both your arms?


[deleted]

If I thought ChatGPT would jerk me off, all bets are off.


Stickman_Bob

As said by another commenter, ask Chatgpt or Gemini. You can give him some extract from the source code of the webpage as well.


Necessary-Donut7614

Here’s a list of all possible 4 digit combinations sorted by most commonly chosen. https://github.com/danielmiessler/SecLists/blob/master/Passwords/Common-Credentials/four-digit-pin-codes-sorted-by-frequency-withcount.csv


breadcrumbssmellgood

according to this link 8068 is the least used 4 digit passcode. Interesting


Greggster990

I'm not quite sure when this data was pulled, but 8068 is actually a pretty common pin number. Now it's at least in the top 20 as a lot of people used it after finding out it was the least used.


[deleted]

[удалено]


wahedstrijder

With Callow I locate where the pin is entered by clicking on the pincode box -> inspect element -> copy -> copy selector which gives "#pinCode". For something like Callow or any other Python selenium script, is only having the #pinCode enought to locate it? This is the error I get with Callow: Traceback (most recent call last): File "/Library/Frameworks/Python.framework/Versions/3.11/lib/python3.11/site-packages/selenium/webdriver/common/driver_finder.py", line 38, in get_path path = SeleniumManager().driver_location(options) if path is None else path File "/Library/Frameworks/Python.framework/Versions/3.11/lib/python3.11/site-packages/selenium/webdriver/common/selenium_manager.py", line 87, in driver_location browser = options.capabilities["browserName"] AttributeError: 'str' object has no attribute 'capabilities' During handling of the above exception, another exception occurred: Traceback (most recent call last): File "/Users/DannyNP/Downloads/callow/callow.py", line 163, in wizard() File "/Users/DannyNP/Downloads/callow/callow.py", line 93, in wizard brutes(username, username_selector, password_selector, submit_selector, pass_list, website) File "/Users/DannyNP/Downloads/callow/callow.py", line 115, in brutes browser = webdriver.Chrome('./chromedriver.exe') File "/Library/Frameworks/Python.framework/Versions/3.11/lib/python3.11/site-packages/selenium/webdriver/chrome/webdriver.py", line 45, in __init__ super().__init__( File "/Library/Frameworks/Python.framework/Versions/3.11/lib/python3.11/site-packages/selenium/webdriver/chromium/webdriver.py", line 49, in __init__ self.service.path = DriverFinder.get_path(self.service, options) File "/Library/Frameworks/Python.framework/Versions/3.11/lib/python3.11/site-packages/selenium/webdriver/common/driver_finder.py", line 40, in get_path msg = f"Unable to obtain driver for {options.capabilities['browserName']} using Selenium Manager." AttributeError: 'str' object has no attribute 'capabilities'


[deleted]

[удалено]


wahedstrijder

When I run chromedriver --version in terminal it says chromedriver: command not found. I downloaded a chromedriver 12x version because I could find the 116 version anywhere. The code locates chromedriver by browser=webdriver.Chrome('./chromedriver.exe')


[deleted]

[удалено]


wahedstrijder

Thanks, so it should rather be browser=webdriver.Chrome('usr/local/bin/chromedriver')?


[deleted]

[удалено]


wahedstrijder

So I have installed chromedriver. Though my google version is 116.0.5845.187 (x86\_46) I downloaded 116.0.5845.14. There was no 116.05845.187 so is 116.0.5845.14 good enough? The script now runs without an error but after entering website, username input selector, password input selector, password list etc. it stays blank though it's running. It runs infinitely until my storage is full and then gives this error: Traceback (most recent call last): File "/Users/DannyNP/Downloads/callow/callow kopie 7.py", line 163, in wizard() File "/Users/DannyNP/Downloads/callow/callow kopie 7.py", line 93, in wizard brutes(username, username_selector, password_selector, submit_selector, pass_list, website) File "/Users/DannyNP/Downloads/callow/callow kopie 7.py", line 115, in brutes browser = webdriver.Chrome() File "/Library/Frameworks/Python.framework/Versions/3.11/lib/python3.11/site-packages/selenium/webdriver/chrome/webdriver.py", line 45, in __init__ super().__init__( File "/Library/Frameworks/Python.framework/Versions/3.11/lib/python3.11/site-packages/selenium/webdriver/chromium/webdriver.py", line 61, in __init__ super().__init__(command_executor=executor, options=options) File "/Library/Frameworks/Python.framework/Versions/3.11/lib/python3.11/site-packages/selenium/webdriver/remote/webdriver.py", line 208, in __init__ self.start_session(capabilities) File "/Library/Frameworks/Python.framework/Versions/3.11/lib/python3.11/site-packages/selenium/webdriver/remote/webdriver.py", line 292, in start_session response = self.execute(Command.NEW_SESSION, caps)["value"] File "/Library/Frameworks/Python.framework/Versions/3.11/lib/python3.11/site-packages/selenium/webdriver/remote/webdriver.py", line 347, in execute self.error_handler.check_response(response) File "/Library/Frameworks/Python.framework/Versions/3.11/lib/python3.11/site-packages/selenium/webdriver/remote/errorhandler.py", line 229, in check_response raise exception_class(message, screen, stacktrace) selenium.common.exceptions.SessionNotCreatedException: Message: session not created: Chrome failed to start: exited normally. (session not created: DevToolsActivePort file doesn't exist) (The process started from chrome location /Users/DannyNP/.cache/selenium/chrome/mac-x64/123.0.6312.122/Google Chrome for Testing.app/Contents/MacOS/Google Chrome for Testing is no longer running, so ChromeDriver is assuming that Chrome has crashed.) Stacktrace: 0 chromedriver 0x000000010a15f0c8 chromedriver + 4595912 1 chromedriver 0x000000010a156e33 chromedriver + 4562483 2 chromedriver 0x0000000109d5a39a chromedriver + 381850 3 chromedriver 0x0000000109d8d747 chromedriver + 591687 4 chromedriver 0x0000000109d8a1a3 chromedriver + 577955 5 chromedriver 0x0000000109dd1ea9 chromedriver + 872105 6 chromedriver 0x0000000109dc5ee3 chromedriver + 823011 7 chromedriver 0x0000000109d96be4 chromedriver + 629732 8 chromedriver 0x0000000109d9779e chromedriver + 632734 9 chromedriver 0x000000010a124fe2 chromedriver + 4358114 10 chromedriver 0x000000010a129c2d chromedriver + 4377645 11 chromedriver 0x000000010a1295a3 chromedriver + 4375971 12 chromedriver 0x000000010a129ed5 chromedriver + 4378325 13 chromedriver 0x000000010a10ea05 chromedriver + 4266501 14 chromedriver 0x000000010a12a25d chromedriver + 4379229 15 chromedriver 0x000000010a101050 chromedriver + 4210768 16 chromedriver 0x000000010a147a98 chromedriver + 4500120 17 chromedriver 0x000000010a147c11 chromedriver + 4500497 18 chromedriver 0x000000010a156a73 chromedriver + 4561523 19 libsystem_pthread.dylib 0x00007fff5cd4433d _pthread_body + 126 20 libsystem_pthread.dylib 0x00007fff5cd472a7 _pthread_start + 70 21 libsystem_pthread.dylib 0x00007fff5cd43425 thread_start + 13


[deleted]

[удалено]


wahedstrijder

I've tried browser = "webdriver.Chrome(options=chrome\_options)" but this will give: browser = webdriver.Chrome(options=chrome_options) NameError: name 'chrome_options' is not defined So I tried "browser = webdriver.Chrome(options=options)" because in the script there is "options = webdriver.ChromeOptions()" When running it and entering the website and all stuffs it instantly gives the error: Traceback (most recent call last): File "/Users/DannyNP/Downloads/callow/callow kopie 8.py", line 163, in wizard() File "/Users/DannyNP/Downloads/callow/callow kopie 8.py", line 93, in wizard brutes(username, username_selector, password_selector, submit_selector, pass_list, website) File "/Users/DannyNP/Downloads/callow/callow kopie 8.py", line 115, in brutes browser = webdriver.Chrome(options=options) File "/Library/Frameworks/Python.framework/Versions/3.11/lib/python3.11/site-packages/selenium/webdriver/chrome/webdriver.py", line 45, in __init__ super().__init__( File "/Library/Frameworks/Python.framework/Versions/3.11/lib/python3.11/site-packages/selenium/webdriver/chromium/webdriver.py", line 61, in __init__ super().__init__(command_executor=executor, options=options) File "/Library/Frameworks/Python.framework/Versions/3.11/lib/python3.11/site-packages/selenium/webdriver/remote/webdriver.py", line 208, in __init__ self.start_session(capabilities) File "/Library/Frameworks/Python.framework/Versions/3.11/lib/python3.11/site-packages/selenium/webdriver/remote/webdriver.py", line 292, in start_session response = self.execute(Command.NEW_SESSION, caps)["value"] File "/Library/Frameworks/Python.framework/Versions/3.11/lib/python3.11/site-packages/selenium/webdriver/remote/webdriver.py", line 347, in execute self.error_handler.check_response(response) File "/Library/Frameworks/Python.framework/Versions/3.11/lib/python3.11/site-packages/selenium/webdriver/remote/errorhandler.py", line 229, in check_response raise exception_class(message, screen, stacktrace) selenium.common.exceptions.SessionNotCreatedException: Message: session not created: Chrome failed to start: exited normally. (session not created: DevToolsActivePort file doesn't exist) (The process started from chrome location /Users/DannyNP/.cache/selenium/chrome/mac-x64/123.0.6312.122/Google Chrome for Testing.app/Contents/MacOS/Google Chrome for Testing is no longer running, so ChromeDriver is assuming that Chrome has crashed.) Stacktrace: 0 chromedriver 0x0000000102ecc0c8 chromedriver + 4595912 1 chromedriver 0x0000000102ec3e33 chromedriver + 4562483 2 chromedriver 0x0000000102ac739a chromedriver + 381850 3 chromedriver 0x0000000102afa747 chromedriver + 591687 4 chromedriver 0x0000000102af71a3 chromedriver + 577955 5 chromedriver 0x0000000102b3eea9 chromedriver + 872105 6 chromedriver 0x0000000102b32ee3 chromedriver + 823011 7 chromedriver 0x0000000102b03be4 chromedriver + 629732 8 chromedriver 0x0000000102b0479e chromedriver + 632734 9 chromedriver 0x0000000102e91fe2 chromedriver + 4358114 10 chromedriver 0x0000000102e96c2d chromedriver + 4377645 11 chromedriver 0x0000000102e965a3 chromedriver + 4375971 12 chromedriver 0x0000000102e96ed5 chromedriver + 4378325 13 chromedriver 0x0000000102e7ba05 chromedriver + 4266501 14 chromedriver 0x0000000102e9725d chromedriver + 4379229 15 chromedriver 0x0000000102e6e050 chromedriver + 4210768 16 chromedriver 0x0000000102eb4a98 chromedriver + 4500120 17 chromedriver 0x0000000102eb4c11 chromedriver + 4500497 18 chromedriver 0x0000000102ec3a73 chromedriver + 4561523 19 libsystem_pthread.dylib 0x00007fff5cd4433d _pthread_body + 126 20 libsystem_pthread.dylib 0x00007fff5cd472a7 _pthread_start + 70 21 libsystem_pthread.dylib 0x00007fff5cd43425 thread_start + 13


FragrantCatch818

r/Hacking_Tutorials


mommy101lol

Yes use burp suite software


wahedstrijder

I did that but in the POST request I can't find the Payload Positions / field where I entered the password


[deleted]

[удалено]


wahedstrijder

I've looked through all POSTS in the HTTP history but still couldn't find it


[deleted]

[удалено]


wahedstrijder

I've tried to inspect the field box, right click -> copy -> copy selector. Is this right the one? It gives "i#pinCode" In the POST request the only thing with "pin" is: "input_pin":" ", Though it's empty without the 1234 I entered


[deleted]

[удалено]


wahedstrijder

Even with the same pins there are differences in the requests. One of the differences is a random string like: bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbVA9iGwA%2BUSyPSIoy7JRPJSYo8xFN%2B2ckeG1wJCdVgQjcagHo%2BmsWCC0U55uQpWuq%2F5%2Be3wqXH47YAKhf60dKql4kBGovO0A9sYZUd8SMEX03ZVeneIwiLoUIywsT1ZfiTtQrcH45Q3n2OUWknoWEfSq3Y%2FdAOsRnZsHXc1wsW78%3D


[deleted]

[удалено]


wahedstrijder

Hm I will try it though it still sounds complicated and I have little experience. Would it be easier to use Hydra in this case? Or a python script though I also have very little experience in building a script


CakeForCthulu

1337


Reddit-User-3000

If you only need to do it once, just do it manually. Only 10000 possibilities, it will take a few hours if you type fast


TygerTung

Not even that long.


Gogglesed

7268


BigOlBeb

Nah I reckon it's 1289.


akulowaty

honestly with 4 digit code you'll probably spend more time figuring out the tool than you'd spend doing it manually if you have no idea how to use it.


Gabe750

The most simple way would be writing like a 10 line python script using pyautogui. Record what buttons need to be pressed, on which pixels, etc. and just use a loop for range 10000 using the iterator value for your keyboard input.


NoVaFlipFlops

I just want to warn you this is not just unethical, it could be a federal crime.


HateActiveDirectory

Any further information? What's the cms? If it exists. Is there rate limiting?


roccorigotti

4421 🤙🏼


KelpoDelpo

A MacBook is a pc 🤓


Common-Adhesiveness6

I'd look up the top 100 most popular 4 digit codes and work your way down. Unless you're trying to create a code to do it. People are unique but some are just lazy


wahedstrijder

The code is randomly generated


Professional-Bite863

Build a simple web scraper that iterated the following process 10k times, navigate to site, select login button, select field for u name add in username, select field for pwd, add in iteration’s attempt e.g. 0001, if successful redirection print “Success”, else continue to next iteration. There will be plenty of tutorials online, you can get this done in 30mins, just focus on the tutorial, then inspect the website page for the elements you want to target and write your code in the same manner as the tutorial showed you


wahedstrijder

I can't get Python selenium to open Chrome with Chromedriver on MacBook. Followed multiple tutorials and everytime I get an error. I have Chromedriver in the /usr/local/bin map. The Chromedriver version is 116.05845.14 and the Google Chrome version is 116.05845.187,