An attack using every possible input to attempt to produce the correct output. Typically the method of last resort when no weakness allows the use of a more restricted input set. E.g. trying all possible (or likely) passwords, in an attempt to guess the correct one.

learn more… | top users | synonyms

0
votes
2answers
17 views

Brute force time estimation - random sequence

I would like to ask if there are 2^1000 possibilities to choose from, how long would it take go through them all on average? (in terms of min, hours or years) Note: This is not necessary related to ...
1
vote
1answer
27 views

Can Hydra and Crunch be used in combination for HTTP-get-form? [on hold]

I'm trying to recover my router username and password without resetting the router for educational purposes. I read that Hydra can be used for "brute-forcing" http-get-form authentication that most ...
0
votes
0answers
57 views

How much does knowing the zxcvbn password strength help an attacker?

On an answer to the question How critical is it to keep your password length secret?, Mike Ounsworth commented that by storing the zxcvbn-calculated entropy of a password you make it easier for an ...
80
votes
11answers
12k views

How critical is it to keep your password length secret?

Is keeping your password length secret critical to security? Does someone knowing that you have a password length of say 17 make the password drastically easier to brute force?
5
votes
2answers
176 views

Do I REALLY need to change my LastPass password?

Last weekend LastPass' network was compromised and that a list of email addresses along with the hashes of the master passwords were stolen. It is being recommended that LastPass users change their ...
0
votes
0answers
81 views

Would it take long to brute force a md5 hash like this?

1be8917510-36.51929856278002 10bce1af27-99.18403192423284 103fa11cc6-87.21158325206488 Few examples above and as you can see the pattern is: 1xxxxxxxxx-{a percentage (0-100) to 14 decimal places} ...
7
votes
3answers
1k views

Why do we have such big keys?

In Chapter 7 of Applied Cryptography, Bruce Schneier claims that, due to thermodynamic limitations, "brute-force attacks against 256-bit [symmetric] keys will be infeasible until computers are built ...
1
vote
3answers
55 views

How can hackers access WordPress usernames? [duplicate]

Recently I've had brute force attack attempts on some of my WordPress sites and the attackers are using actual usernames other than the default admin (which was removed). How is it possible for them ...
20
votes
4answers
3k views

How is Gmail susceptible to brute-force attacks?

In the Atlantic article "Hacked!" it says: My wife’s password was judged as “strong” when she first chose it for use with Gmail. But it was a combination of two short English words followed by ...
-1
votes
0answers
29 views

How to perform a hybrid online attack

I understand how dictionary attacks and brute force attacks work. And as far as I get it if I know that the password contains the string "Foo" but might also contain other stuff like numbers, the best ...
8
votes
4answers
264 views
+100

What are the drawbacks of login request throttling?

In a web application, one way to protect against password guessing attacks is to lock out accounts after a set number of failed logins. This could be done on both source IP address and username. For ...
1
vote
2answers
80 views

How much faster does a GPU or FPGA crack an RSA key compared to a CPU?

Are there any significant speed up in time on cracking an RSA key (either brute-force or factoring with general number field sieve) using a GPA or FPGA compared to a CPU? If there is a speed ...
1
vote
1answer
59 views

how to get cookies from aspx site to use it with hydra

I've been playing around with Hydra and .aspx site and I've hit a bit of a snag - Hydra responds letting me know that the first 16 passwords in my password list are correct when none of them are. ...
4
votes
1answer
111 views

Analyzing log files for forensics homework?

Suppose two users have done a murder at 6pm at Dunkin Donuts, I have got the hard disks on site, disk1 and disk2. How do I identify the time and order of each user's activities on the hard disks? ...
3
votes
3answers
89 views

How is truncation according to PCI DSS secure?

In section 3.3 of the PCI standard, it says that when displaying PANs, limiting visibility to the first 6 and last 4 digits of the PAN is considered secure. Doing some quick math, on a 16 digit PAN, ...
1
vote
1answer
74 views

Brute force a password with a lot of hash (of the same password)

I have a list of approximatively 1000 entities, defined using the following code : list[i] = md5_salt_unix_hash(random_salt, password) Where the random_salt is generated in each iteration and the ...
5
votes
1answer
188 views

Are these access.log entries successful wordpress login attempts?

I am hosting some wordpress sites on an apache 2.4 webserver, and I have discovered thousands of entries in my server logs like this: 221.219.219.248 - - [09/Mar/2015:03:29:25 +1300] "GET ...
6
votes
3answers
236 views

Is Twitter digits login (sms auth code) insecure?

Twitter released(some time ago) a new kit named Digits which allows the client to login with a phone number and an authorization code (received through sms). I find it great for the user experience ...
2
votes
0answers
59 views

Why does Hydra not stop when it finds a password? [closed]

Why does Hydra 8.1 not stop when it finds a password? I am using the -P option with a file that has over 5 Million passwords in it and the correct SSH password is located at approx. line 2100, but ...
4
votes
0answers
83 views

Random padding in hash functions

In this answer, it was recommended that you add random padding when hashing messages for a trusted timestamp, such as for predictions, in order to avoid dictionary and brute force attacks (at least ...
3
votes
3answers
2k views

How can Facebook possibly stop a bruteforce attack on an account?

I've been doing some research on hacking recently and I found some very interesting tutorials on brute force cracking. I have some questions to ask and I'll be using Facebook as an example. Let's say ...
-2
votes
4answers
160 views

Getting password cracking time and byte storage from bruteforce?

I am stuck with this question, you can see it in the picture I have included below. PARTS (a and b) I know a-z will be 26^8, A-Z will be 26^8 guesses, and 0-9 will be 10^8 guesses. But I can't relate ...
0
votes
2answers
46 views

Library or service for rate limiting credit card transactions by IP [closed]

I have a simple product ordering form. A hacker is attempting to validate stolen credit card numbers by making two orders per minute with a bot. 99% of the orders are declined but some are ...
9
votes
4answers
6k views

In light of the FREAK TLS vulnerability, why do so many servers still offer RSA-EXPORT keys?

Ars Technica is reporting on a new attack against HTTPS. Called FREAK, the devices reported as vulnerable include iPhones, Android devices, and Macs running OS X. The attack (as has been clarified ...
1
vote
1answer
99 views

P12 private key vs private key file : what is more secure?

The question is a bit tricky because they don't have the same purpose but : Do both kind of file face the same security issue concerning private key protection : password strenght ? (PBKDF2 as both ...
3
votes
3answers
272 views

Calculate time taken to break AES key

A 256 bit AES key is required to be broken using the brute force method on a 2GHz computer. How long would it take to break the key in the best case and in the worst case situations? Assume that 1000 ...
6
votes
2answers
135 views

Realistically, how much added security does having a passphrase on a ssh key have?

Let's assume ssh key brute force is unrealistic. It seems to me your greatest vulnerability would be someone gaining access to a client filesystem. If that's the case then key loggers and a host of ...
1
vote
2answers
94 views

Circumventing disadvantage of IP-based account lockout

So we're trying to prevent brute-force attacks on our web server login page--currently we just do IP-based locking if x failed attempts from IP address Y occur over z time period. After a security ...
2
votes
1answer
48 views

Avoid brute-force enumeration of customers in a SaaS application

I'm involved in the development of a SaaS application. We host the application for different customers. A customer is a company. Each customer gets access to their hosted instance of the application ...
1
vote
2answers
172 views

Session Hijacking through sessionId brute-forcing possible?

cookies usually contain a sessionId to keep track of a logged user. What would prevent a malicious user to forge millions of requests with random sessionIds and send them to a server, hoping to ...
8
votes
1answer
253 views

Can/do botnets brute force “high value” users of services like Gmail?

On an intranet a login is generally disabled after a very small number of failed logins. But a public email service like Gmail can't do the same, otherwise pranksters would just be continuously ...
0
votes
0answers
34 views

hydra password penetration test syntax [duplicate]

I am trying to penetrate a password on my own website using hydra. Let's say that I know login and password and i just put both there like in sample below: hydra -l admin -p password 123.123.123.123 ...
1
vote
1answer
134 views

Use THC hydra to make dictionary attack on localhost

I have programmed a log in in my webpage and now I want to test it against a dictionary attack. I am using Apache and my website is not online so to access it I connect to localhost/website In hydra I ...
0
votes
2answers
443 views

Scan all possible files on server (Brute force Filenames)

I'm not sure if I'm right here, but I just wanted to know if there is a tool that scans all possible filename combinations on a server and tells you what filenames the server responded to. So it would ...
0
votes
1answer
88 views

Why doesn't SSH use a better algorithm for encrypting keys?

According to the answers in this question, SSH still uses a very basic algorithm for encrypting keys with a passphrase, which can be attacked at a rate of billions tries per second using dedicated ...
0
votes
1answer
162 views

When bruteforcing a WiFi network password, Can that admin see it?

When bruteforcing a captured packet containing the encrypted password, can the owner/admin of the router see each auth attempt? I'm assuming you just encrypt each passphrase in the dictionary file and ...
0
votes
1answer
153 views

Brute force attacks detection risks

I would like to ask if using brute force attacks on some websites or online services can be risky in any way for the hacker? Let's say that someone is using medusa tool to crack password on his ...
0
votes
1answer
177 views

How to use multiple charsets in hashcat

I wanted to use a brute force attack on hashcat but WPA/WPA2 networks are 8-64 characters long and they have multiple possibilities of a password. I was wondering if there was a way to use multiple ...
1
vote
2answers
197 views

Adequate prevention of distributed brute force attacks?

What are good ways to prevent distributed brute force attacks on my website? I think (not sure. if someone can assure me, thanks!) my site is secure against normal brute force attacks as I am using ...
0
votes
0answers
156 views

THC-Hydra dictionary attack on JSP login form

I am trying to use Hydra to attack a JSP form but I have some confusion. Normally we use command something like this hydra -L list_user -P list_password HOST-ADDRESS http-post-form ...
1
vote
0answers
34 views

THC-Hydra - one good pass = shows all valid [duplicate]

As in title. I'm testing my router security and I came up with problem. hydra 192.168.0.1 http-get-form "/:un=^USER^&pw=^PASS^:User Name or Password is incorrect." -L usernames -P passwords ...
3
votes
1answer
214 views

Can a Windows or Linux password be brute-forced on a public network?

I am at a hotel that has a public network. I have a Windows machine with a wired connection to it. "Network and Sharing" has network discovery on. No folders are shared except "Users", which is shared ...
17
votes
5answers
485 views

What concrete parameters can I change to make my passphrase-protected private gpg key more secure

There are several questions which discuss the resistance of passphrase-protected private gpg keys against brute force attacks. It seems, this kind of discussion could go on forever. Rather than ...
2
votes
1answer
80 views

Long passwords and key derivation functions

Not being a security expert, I have a rather theoratical question that I have been thinking about for quite a while now: Let's imagine an encryption software that takes a user-provided password, ...
0
votes
0answers
282 views

Can everyone find the pictures one sends over whatsapp?

I was trying out a whatsapp compatible chat application on my laptop. Someone sent me a picture and I received a link to that picture on the whatsapp server. Everyone who visits the link can see the ...
14
votes
5answers
2k views

What is the difference between login throttling and temporary account lockout? [closed]

I am currently working on the redesign of a login page. I have initially suggested that login be throttled whereby pauses (incremental - in number of seconds) are introduced between each failed login ...
0
votes
1answer
377 views

Reporting an IP address

This morning while checking /var/log/secure to troubleshoot an issue with my Centos VPS, I found that there has been too many SSH bruteforce attempts from 54.93.174.60 for the past couple of days. I ...
0
votes
1answer
151 views

Can a botnet be used to effectively break encryption keys?

Can a botnet amass and coordinate enough computing power to break encryption keys that are typically considered to be secure (through brute force)? If this is the case, do we need to make our ...
4
votes
1answer
1k views

Can this be a DoS Attack?

When I'm checking my log, I found like 15k events of " PAM service(sshd) ignoring max retries; 6 > 3 " I know this might be normal, and considered as Brute-Force attack, but can it be classified as ...
-2
votes
2answers
86 views

Strength of WPA passwords

How long would it take to crack an 8 letter (latin alphabet, lowercase) password of a WPA PSK network? Is it in reach of a single PC running hashCat?