Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I was wondering how bruteforce methods work from a code level. How does the code get access to a login page for example and insert information into the necessary fields? And is the code able to duplicate the system so that 3 attempts or waiting between guesses is no longer a problem?

share|improve this question
    
I assume the code uses something simple like the PHP "POST" function. If it is something you have access to and can replicate, say a computers SAM and CONFIG files, it is possible to split the brute-forcing capability between multiple computers to speed up the process. –  ekaj Jul 30 '13 at 20:11
add comment

1 Answer

up vote 6 down vote accepted

There are online attacks and offline attacks.

Online attacks are when the attacker tries each password by sending it to the attacked system. The attacked system might be using, for instance, an HTML login page; in that case, the attacker would first manually obtain a copy of the login page (like any other user, with a Web browser), then look at the HTML, and infer the format of data that is sent to the server. Most login pages are simply HTML Forms; when a user enters the login and password and clicks on the "log me in" button, the browser sends an HTTP request which encodes the data entered by the user. The attacker then just has to build, with some custom code, synthetic HTTP requests which use the same format.

As for how often the attacker will try... well, it depends. On one hand, the attacker has a lot of passwords to try, so he will send many requests, include a lot in parallel because the server itself can handle several incoming requests simultaneously, and will process more requests per second when used in parallel than if the client (the attacker) waited for an answer before sending his next request. Parallelism absorbs latency, in a way.

On the other hand, some sysadmins include detection systems for "suspicious activity" and receiving 100 login attempts for a given user login per second surely looks unnatural. Therefore, some attackers will try the low-profile thing, trying only one password at a time, and waiting several minutes between any two attempts. The attacker tries to stay under the radar. This can still be an efficient strategy for the attacker, if he has lots of user logins to try on lots of distinct servers.

Offline attacks are very different. In an offline attack, the attacker was lucky enough to obtain enough information to "test passwords at home". For instance, through some SQL injection attack, the attacker grabbed a copy of the hashed passwords for a thousand users of a given site. The attacker can then proceed to "try" passwords by hashing each potential password and seeing if the hashed version matches the database table that he previously purloined. All of this occurs on the attacker's PC, with no network at all, and nobody else is made aware of the cracking effort.

Offline attacks are a bigger worry than online attacks because in an offline attack, attackers are limited only by their available computing power; there is no honest server who can arbitrarily limit the rate at which passwords can be tried. With simple hashing functions, attackers can try billions of passwords per second, with off-the-shelf consumer hardware (a PC with a big, gaming-class GPU). There are mitigation measures but they are not perfect (they are relatively expensive trade-offs). It is much better to avoid offline attacks in the first place (i.e. check your SQL statements, dammit !).

share|improve this answer
    
Also don't forget about CSRF protection in online attacks. It can stop attackers right at the beginning. –  byf-ferdy Jul 31 '13 at 8:12
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.