To define your own cgi cracking mode create a file containing the
following information, each one on a different line:

server 
HTTP request
what to search for
the number of line to read


- server : The web server hostname or IP address

- HTTP request : The simple or full HTTP request you want to send to the
server. See rfc 1945 is you're not familiar with HTTP. POST is not
supported btw. In the url, where you would enter your login name, use
LOGIN. Where you would place the password, write PASSWD.

- what to search for : A string to search for in the reply. You can also
search for anything else than that string by adding ! in front of it. By
default the program search for the string at the begining of the reply
line. Add ] in front of it to make the program search at the end. (You can
also add [ to make it search at the begining but it's not necessary.) If
you let this line empty in the file the program will display on screen
every line of the reply up to the number of line to read. It's usefull to
find what to search for ( especialy in HTTP headers that your browser
doesn't display).  

 - number of line to read : This is the line number for where to search in
the reply.  


Ok, ok, we'll do an example. Suppose you'd like to crack hotmail hint
using this rather that thetaprog. You create a file name whatever.txt and
place those line in it:

207.82.250.251
GET /cgi-bin/checkhint?login=LOGIN&PwAnswer=PASSWD
<p
17

And know you do java gammaprog -c johnsmith@whatever.txt password.lst

Gammaprog will now connect to www.hotmail.com, send the HTTP simple
request GET /cgi-bin/checkhint?login=LOGIN&PwAnswer=PASSWD where LOGIN
will be changed for johnsmith and PASSWD will be a word from password.lst.
It will then read 17 lines and look if the line starts with <p. If so, it
will say password found. So next time hotmail change their hint cgi you
won't e-mail me asking for a new thetaprog version, you'll just create a
new cgi cracking config file. 

Understood? Another one? Ok. 

Ever saw those page protected by a JavaScript passwd? Like they prompt you
for a passwd and if you enter java they send you to java.html. Of course
java.html doesn't exist on that server and you know you entered the wrong
passwd. Can gammaprog crack these now? Maybe. First, create a debuging
file:

server
GET /PASSWDLOGIN HTTP/1.0

10

Then start gammaprog using java gammaprog -cs 1 .html@javascript.txt
password.lst. So if the first word in your wordlist is internet the
program will try to get internet.html. Since I didn't place any string to
search for the program will display the 10 first lines.

HTTP/1.1 404 Not Found
Date: Mon, 22 Feb 1999 00:50:38 GMT
Server: Apache/1.3.4 (Unix) FrontPage/3.0.4.2 PHP/3.0.6
Last-Modified: Wed, 01 Jul 1998 06:51:30 GMT
ETag: "95803-63c-3599dc72"
Accept-Ranges: bytes
Content-Length: 1596
Connection: close
Content-Type: text/html

Now what to search for? We have no idea what the correct page will look
like! That's the hole idea of the ! "operator". We'll search for something
different than what we got. What's likely to change in this reply when we'll 
get the correct page? The HTTP reply status code of course. That 404 Not
Found won't show in the reply when the passwd will be correct. However, if
our wordlist contains the word "index", when we'll ask for index.html the
404 not found will be gone too and the program will stop and say password
found though it's not the page we're looking for. No problem, we'll use
reverse cracking. Our config file is now

server
GET /LOGINPASSWD HTTP/1.0
!HTTP/1.1 404 Not Found
1

And we start gammaprog using java gammaprog -cvR .html@javascript.txt
password.lst

Then we look at login.log and try every file listed there in our browser.
Maybe the secret one will be amoung them. Maybe not.


So, that's it. You can send me the config files you make if you want. I'll
add them to my homepage or to the next release of gammaprog. 

An Eyewitness
aneyewitness@geocities.com
99/02/21
