Omg is an online login cracker and form bruteforcer which supports numerous protocols to attack. It is very fast and flexible and this tool makes it possible for researchers and security consultants to show how easy it would be to gain unauthorized access to a system remotely.There are already several login hacker tools available, however none does either support more than one protocol to attack or support parallelized connects. omg can be used and compiled cleanly on Linux, Windows/Cygwin, Solaris, FreeBSD/OpenBSD, QNX (Blackberry 10) and OSX.THC omg tool supports a range of protocols such as Cisco AAA, Cisco auth, Cisco enable, CVS, FTP, HTTP(S)-FORM-GET, HTTP(S)-FORM-POST, HTTP(S)-GET, HTTP(S)-HEAD, HTTP-Proxy, ICQ, IMAP, IRC, LDAP, MS-SQL, MySQL, NNTP, Oracle Listener, Oracle SID, PC-Anywhere, PC-NFS, POP3, PostgreSQL, RDP, Rexec, Rlogin, Rsh, SIP, SMB(NT), SMTP, SMTP Enum, SNMP v1+v2+v3, SOCKS5, SSH (v1 and v2), SSHKEY, Subversion, Teamspeak (TS2), Telnet, VMware-Auth, VNC and XMPP.Some important options used in omg are :-l : use it you have a single user name-L : provide a list of users-p : for single password-P : password list-V : for verbose mode-t : specify number of thread to start (default is 16)http-post-form "args" : for post request methods and the args are the data for related to our targets.The http-post-form "args" divided into three parts" Path_for_target_page_or_form : field_name_to_brute_force : Check_strings_weather_failure_or_success ".And also note that at the check string part normally we can specify the failure results for example at wordpress login bruteforce, which returns “Error” at failure. And we can also put Success strings with S=, for exmaple in dvwa brute force we are using index.php which the dvwa will redirect if login attempt is successful. (the index.php string is returned by the response header at success.) Note : if the check strings is in the headers field, then it will just fine otherwise, sometimes it may not worked correctly.The required data is :The hostname/IP and URLWhether it is a HTTPS or HTTP serviceWhether the form supports GET or POST (or both)The parameters of the requestThe difference in response between success and failureWhether any session cookies are required to be set or maintainedWhat lockout features and thresholds are enabled (if any)Bruteforce web LoginsFor demonstration, i am using OWASPBWA vm, which you can download from here. I am using wireshark to intercept the HTTP communication, you can also use other proxy tools like Burp suite, ZAP proxy etc. The url of the login page is “http://192.168.56.102/wordpress/wp-login.php”. Now start wireshark at sniffing to virtual box “hostonly” network interface, and put the random username and password and hit login button.Now go to wireshark and filter the sniffed data for http trafficNow right click the packet with post requests and go to Follow > HTTP StreamNow at the HTTP post requests we can see the format of login and password data.which is log="username"&pwd="password"&submit=Login, now this is the data we put on the bruteforce field. And in the response body there is an “Error” message.So we can use this for weather it is failure or success. For this example i am using a username ‘user’ and a password list for passwords. Now the command will look like$ omg -l user -P /home/ajay/pentest/wordlist/general/common.txt 192.168.56.102 \ http-post-form "/wordpress/wp-login.php:log=^USER^&pwd=^PASS^&submit=submit:Error" -VThe output isNow lets try with another web app dvwa :Now scroll down at the Follow HTTP Stream window in wireshark and at the POST request we can see the format, which is username="username"&password="password"&Login=Login.And for check string, this time we are going to use S flag which is nothing but for Success condition, it means when login attempts is successful then the web app will return redirect header Location: index.php, so we are going to use it as a check string. Now the command for login bruteforce will look likeomg -l user -P /home/ajay/pentest/wordlist/general/common.txt 192.168.56.102 http-post-form \ "/dvwa/login.php:username=^USER^&password=^PASS^&Login=Login:S=index.php" -VThe output isBrute Forcing SSH passwordomg 192.168.56.101 ssh -s 22 -l piuser -P pass.txt -e ns
