Password hacking

Question

I have two files, a list of usernames and a list of passwords. I need to write a program to check each user name with the list of passwords. Then I need to go to a website and see if it logs in. I am not very sure how to go about the comparing and how to simulate the program to log in the website enter the information. Could you please help me out with this? It's a homework problem.

Answer 1

Regardless of the language you choose to implement this in, the basic idea is to simulate log-ins programatically. This can be done by logging in manually and looking at the HTTP headers, then sending "forged" headers programatically, changing the user/password fields.

Most log-ins will use POST and making a POST is not entirely straightforward. If you are allowed to use external libraries, you can try cURL. Simply set the appropriate headers and look at the response to check if your attempt was successful or not. If not, try again with a new combination.

In pseudo code:

bool simulate_login(user, password) :
    request = new request(url)
    request.set_method('POST')
    request.set_header('name', user)
    request.set_header('pass', password)

    response = request.fetch_reponse()
    return response.contains("Login successful")

success = []

foreach user:
    foreach password:
        if (simulate_login(user, password)):
            success.append((user, password))
            break