
Gammaprog is a bruteforce password cracker for web based e-mail
address. Actually was, cause now it supports pop3 cracking too. Currently
hotmail.com, usa.net and yahoo.com address are supported but you can add
your own (See CgiConfig.txt).  The program is written in Java, so it should 
run on any computer equiped with a Java virtual machine. It's not an applet 
however, it won't run from a web browser. If you don't have a Java virtual 
machine, you can get one at http://www.javasoft.com/products/index.html. 
Get JDK or JRE. JRE is much smaller and if you have no java coding
experience it is all you'll probably need.  See FAQ.txt for more details.

New with version 1.5

- You can configure the cgi cracking mode. Rather than cracking only
hotmail, usa.net and yahoo!, you can config it to crack other things. See
CgiConfig.txt for info about how to create a config file. 

- Fixed a few minor bugs. 


New with version 1.4

- You can now save your cracking session to a file and restart from where 
you left.

- I added a form of benchmark. You start the program as usual but after a 
while it stops and displays the number of word tried, average number of 
word per minute, etc. Usefull to ajust the number of socket.

- The log file for reverse cracking now contains the e-mail address and the 
password rather than just the login name. Otherwise you end up with lists of 
login you don't remember the password. 

- I fixed a bug in the rules implementation. Rules were sometimes apply to 
a null object when EOF was reached, causing the thread to crash. 


Installation and usage

First, notice that if you're using windowns, all the following must be type
from DOS. Gammaprog is a text mode program. Assuming you have JDK and 
gammaprog source code, compile it with
	javac gammaprog.java

And run it with
	java gammaprog <option> <address> <word list>

You can also use the precompiled classes and skip the compiling phase. 
The classes were compiled with JDK1.1.5-v7 under Linux on a i586. 
They should run on any system though. 

If you use JRE 1.1.* , try
	jre gammaprog <option> <address> <word list>
or
	jre -cp <directory where gammaprog is> gammaprog <option>
<address> <word list>

With JRE 1.2.* just do like with JDK as explained above. 

- option are:
	c : cgi cracking mode (for yahoo, hotmail, usa.net). You can also
	add your own. See CgiConfig.txt.
	p <number > : pop cracking mode (for pop3 account) followed by the 
	number of tries the pop server let you do before disconnection. 
	Some let you do unlimited tries, some disconnects after 3, some 
	after 1, etc. 0 is for unlimited tries. If you don't know the 
	correct number, use 0. It might be a little slower however.
	R : reverse cracking mode. Tries the same password against different
	login names. 
	f <file> : log cracked logins into file rather than to login.log (for 
	reverse cracking only). 
	t : enable timeout on socket. This makes sure pop3 sockets won't 
	block forever. On my linux jdk port it was slowing me a lot so I made
	this optional. On win95 jdk1.1.5 it doesn't appear to be slower.
	v : verbose mode. Displays passwords tried and replies on screen.
	s <number> : socket number. Default is 10. This is use to set the 
	number of socket you want to run in parallel. Each socket is a 
	connection to the server btw. Adjust this value to fit the speed 
	of your modem. In pop mode, you can run much more sockets because 
	each use a really small amount of bandwidth. I don't know the best 
	value actually, so experiment.
	r : apply rules on words.
	C : apply case related rules on words. 
	b <number> : perform benchmark during number of second. When the 
	time is over you'll see the number of words/min. This should help 
	you find the best number of socket to use.
	a : autosave session (to autosave.txt). The session is saved 
	automatically every 60 seconds. Restart from where you were with the 
	-l option. When restarting you should keep a command line similar to 
	the one of the saved session otherwise you won't start from the rigth 
	place. Things like the number of socket can be changed however.
	l : load previously saved session (from autosave.txt)	

	
- address is of course the e-mail address you want to crack. When cracking 
a pop3 address, make sure there's a pop server on the second part of the
address. Cracking aneyewitness@geocities.com won't work cause there's no
pop server on geocities.com. The pop server is on mail.geocities.com, so
enter aneyewitness@mail.geocities.com in the address field. 
  When doing reverse cracking, the login part of the address field will be
the password used and the real login will be read from the word list. If 
no login is present (like @mail.geocities.com) the login and the password 
will be the same. 
  If you create your own cgi cracking mode, rather than the server enter
the name of your config file. 
 
- word list is the dictionary file you want to use. A short one comes with
gammaprog (common-passwords.lst). Here's a good link where you can find
wordlists:
	http://www.genocide2600.com/~tattooman/new.shtml


A few words on rules

  Suggestions on new and better rules are welcome. There's only 5 simple
rules now. Since some password are not case sensitive (hotmail for one) I
divided the rules in two groups (option r and C). They don't overlap, so 
using both is fine. Second, the word is never tried exactly as in the word 
list. Thus trying the word list without rules and then with rules is also 
fine. Currently the rules are:
      - word to uppercase
      - word to lowercase
      - first letter to uppercase
      - reverse the word
      - change e, a and o for 3, 4 and 0


Examples:

1)	java gammaprog -c someone@yahoo.com password.lst

This cracks someone@yahoo.com through the cgi using 10 sockets.

2)	java gammaprog -tvp 0 -s 50 someone@pop.hotmail.com password.lst 

This cracks someone@hotmail.com through POP3 using 50 sockets, timeout 
enabled and no limits on tries for each connection. 
 
3) 	java gammaprog -trvp 0 -s 50 someone@pop.hotmail.com password.lst

Same as above except that non case related rules are apply on words.

4)	java gammaprog -tralvp 0 -s 50 someone@pop.hotmail.com password.lst

Same as above except that the session is loaded from a previously saved one 
and this one is also automatically saved. 

5)	java gammaprog -vp 1 -Rf school.txt girlfriend@school.edu login.lst

Checks if someone at school has your girlfriend name for password (besides
you, of course) and logs the result to school.txt.

6)	java gammaprog -b 60 -p 1 -s 25 someone@mail.geocities.com password.lst

Test during 60 seconds if 25 sockets is fast when cracking a geocities account.

7)      java gammaprog -cv someone@hotmailhint.txt password.lst

Do cgi cracking using the configuration from hotmailhint.txt ( The
hotmailhint.txt file from gammaprog.tgz cracks hotmail hint just like
thetaprog 1.03 does. But you can save your session, do reverse cracking,
benchmarking, etc.)


If you have technical suggestions or feedback feel free to mail me. Bugs 
report are always welcome. If you have problems running the program read
the FAQ first please...
 
An Eyewitness
99/02/21
aneyewitness@geocities.com


