An attack using every possible input to attempt to produce the correct output. Typically the method of last resort when no weakness allows the use of a more restricted input set. E.g. trying all possible (or likely) passwords, in an attempt to guess the correct one.

learn more… | top users | synonyms

-1
votes
2answers
43 views

Is it possible to perform bruteforce attack with proxy on a website?

When one does brute force attack online, most probably the person will get caught easily,isn't there a way of doing brute force for example on a website without getting caught?
1
vote
2answers
87 views

Are password-guessing attacks a real threat?

There are tons of questions, answers, articles, papers, cartoons etc. on the subject of how to choose a password in such a way that it's difficult to guess or crack with a dictionary-based attack. I ...
0
votes
0answers
26 views

Generate Custom Brute Force Dictionary from Partial Knowledge of Password [closed]

I'm trying to create a wordlist to brute force an old TrueCrypt volume I found. I have a hazy memory of what the password is, and I'm confident I can brute force it if I can get together a password ...
1
vote
1answer
271 views

Law enforcement cracked my phone?

Police took my android phone a few months ago. It was encrypted and had the 10 max tries destruction thing set on. I noticed that yesterday the device disappeared from my android device manager. ...
0
votes
3answers
170 views

How to (further) ensure SSH security?

I set up my Linux Ubuntu machine as an SSH server through no-ip.com and it works great. Recently I discovered the command, sudo lastb -ad -F -w which outputs a log of the most recent failed SSH ...
0
votes
1answer
47 views

Using Hydra with Cloudflare [closed]

I've just paid for a CloudFlare plan: the documentation says it should reduce bruteforcer/DDoS attacks, but a guy succeeded to bypass cloudflare checking (maybe called 'Under-Attack'), bruteforced my ...
5
votes
1answer
135 views

Blocking Chinese IP addresses

I recently checked one of my servers' auth.log file and noticed some very suspicious activity. I recently shut down my server's ssh daemon, so the logs end on Jan 22, but what I noticed after ...
26
votes
10answers
5k views

Could I recover the content of file from its checksum/hash?

Let's say I have a video file that is split into multiple parts. Each piece is 2 Megabytes. I also have a list of the *insert hash name here* for each piece and also for the full file. Now assume ...
1
vote
1answer
96 views

How to brute force HTTP Basic Authentication requested with XHR?

How can one brute force a website using HTTP Basic authentication using metasploit which uses XHR in background? I am getting error "No URI found that asks for HTTP authentication". Relevant headers ...
0
votes
1answer
56 views

Can a brute force attack be certainly prevented on a unix/linux shell?

I've been getting kind of curious about computer security. I know brute force has been discussed a fair bit on Stack, but I want to elaborate a bit by asking, "Is it possible to /certainly/ stop ...
1
vote
1answer
103 views

How does encryption strength make a difference to an attacker

Take for example I have my social security and other personal information stored as a string that I am trying to encrypt on my local drive. My first method of encrypting the string is to use a ...
0
votes
1answer
84 views

How to brute-force WPA-2 password of specific set of characters using oclHashcat?

I want to test oclHashcat on a WPA-2 PSK password of length 8 containing only characters in the set {a-z, A-Z, 0-9}. To do this I have already captured the handshake in a .cap file and converted it ...
-1
votes
1answer
31 views

Brute forcing using hydra

I'm try to do brute force attack on a system and I have complete word list of the possible passwords because they use a really simple format but when I tried hydra with the following post responses, ...
1
vote
2answers
80 views

Exclude passwords with repeating letters

It would cut down a lot of time of the brute force attack if some of those passwords like "aaaaaa" wouldn't appear. How can this be achieved in Hydra or some other brute force software?
7
votes
3answers
3k views

Why is it harder to brute force an iphone than a zip-file?

Having only 1,000,000 possible combinations, an encrypted zip-file with a 6-digit numeric password, could be brute force cracked within a second. But for an iphone (let's say iOS9 if it matters), it ...
2
votes
3answers
91 views

Nmap http-brute - Supplying arguments for bruting via GET

I'm attempting to brute a site in my test lab with Nmap's http-brute nse, which has the URL structure https://192.168.101.6/api/auth?email=a@b.com&password=pass Unfortunately Nmap's official ...
53
votes
8answers
9k views

Am I experiencing a brute force attack?

When checking the auth log of a server with the command: grep sshd.\*Failed /var/log/auth.log | less I see thousands of lines like this: Jan 12 11:27:10 ubuntu-leno1 sshd[8423]: Failed ...
3
votes
2answers
112 views

Is there known statistics of passwords used during brute force password attacks?

I have been reading quite a bit about brute force attacks and I am wondering whether the passwords that are used in such attacks should be kept around so as to later prevent my users from having those ...
3
votes
0answers
25 views

Reaver stuck at flow_handler

I tried to run Reaver against my router at home using an Ubuntu 15.10 laptop. The command used was: sudo reaver -i mon0 -b XX:XX:XX:XX:XX:XX -vv -c 7 -a (the channel I got from aerodump-ng). I'm ...
2
votes
0answers
34 views

Customize John The Ripper BF technique

Is it possible for me to customize the way John the Ripper brute forces a .cap file? I, knowing my WiFi password, want to crack it fast as possible (no hit with word list). Can I customize John to ...
1
vote
1answer
64 views

Is it secure to allow an account to use `test123!` as their password?

I'm working on tightening up security for the auth layer of my app and I'm currently making a call on the complexity I'll require for passwords. Is there a 'standard' recommendation for complexity? ...
1
vote
0answers
41 views

trapdoor information with hash functions

I have been playing with an idea for the past few days. I have been unable to find information on here or crypto.stackexchange about using trapdoor information in the input to a hash function. ...
1
vote
1answer
83 views

SSH Key vs Complex Password with Fail2Ban & Two Factor Authentication

Normally you hear that using an SSH Key is far more secure than using a regular password. However I've been wondering if this statement is really true. Let's say we have the following variables for ...
20
votes
7answers
3k views

Are reCAPTCHA enough to prevent brute-force password guesses?

I was wondering if reCAPTCHA were strong enough to prevent BruteForce from bots or if I needed to add more security, such as sending a unique mail to the user every 5 tries that someone try to log on ...
-2
votes
1answer
116 views

Can someone bruteforce my OSX? (Macbook)

Is it possible for someone to bruteforce or perform a dictionary attack on a Macbook? It's very easy to bypass security of a Windows box (Password Protection) , what is the difficulty level of ...
7
votes
2answers
80 views

Is lack of wildcard DNS entry a security vulnerability?

A friend of a friend received an email from a security researcher that looks legit. Researcher submitted several vulnerabilities, one of the them reads like this Vulnerability # ... Title : ...
-1
votes
2answers
110 views

Hydra producing fake login passwords

I'm trying to "hack" (login) into my own HTTPS website account through Hydra. Therefore, it is 100% legal. Hydra keeps producing tons of incorrect passwords. This is the code I use: hydra -v -V -l ...
0
votes
0answers
70 views

Hydra command for cracking a webpage which uses <span> tag for failed login attempts

I'm trying to for crack a simple webform for testing hydra in Kali. When the webpage encounters a wrong username and password combination it pops up a message using the following html code:: ...
-1
votes
1answer
132 views

ISP has informed us that our server is launching brute force attacks on WordPress sites, how do we end this? [duplicate]

Misc Situation: -Server login is obtained by hacker, hacker places malicious brute force file in /hacked/bruteforce/ -Server password is then changed, hacker can still run script by navigating to ...
1
vote
1answer
56 views

How effective are firewall rate limiting rules for slowing down brute force and DOS attacks?

I am investigating methods to slow down the rate at which attackers can make brute force attempts against my webserver's SSH and HTTP services. I have come across many articles as well as the ...
1
vote
0answers
51 views

How secure is Asus router latest framework function: “Added protection mechanism for GUI login brute-force attack for login username and password.”?

I have just updated my RT-N12 D1 router to the latest framework, and it has new function - "Added protection mechanism for GUI login brute-force attack for login username and password.". I Googled and ...
0
votes
1answer
106 views

Test a known list of possible Windows Remote Desktop credentials?

I've forgotten my password to my home server. It's a new Windows 2012R2 VM, I didn't change the maximum password age requirements in Group Policy DC (even tho I know I should have) until it was too ...
1
vote
2answers
125 views

Why do websites force the user to use a long and complicated password when brute force isn't possible?

if you have a phone with 4-digit pin and the phone does not get locked no matter how many times you put the wrong pin it makes sense to use 10 or 16 digits as it'll increase the time the attacker ...
4
votes
3answers
265 views

Can using emojis make someone's password safer?

I was just thinking about this the other day, after reading about making safe passwords, you have a few options: The first would be, adding numbers, or something other than just a word ...
5
votes
1answer
158 views

Is there an equivalent of an Apple cryptochip in Android devices?

Apple has a cryptochip which, beside managing the encryption keys, tunnels authentication and provides throttling of failed attempts, as well as the ability to trigger a device wipe after several ...
2
votes
2answers
78 views

REST Services: Limiting the concurrency of a login endpoint

Scenario: A botnet is recruited to try to authenticate against a website or service with each bot trying infrequently using a common password and a list of 'real' email addresses, avoiding the ...
2
votes
1answer
105 views

Bruteforcing an iOS PIN

The iOS Security document describes several security mechanisms implemented in iOS 9. I am specifically interested in the actual security of a 4 digits PIN on iOS. I am looking for tangible ...
1
vote
2answers
593 views

What would be the most efficient way of brute forcing a wifi key [duplicate]

I was wondering how can a brut force of my wifi be prevented so I want to know the best technique that can be used to brute force it first, so protection isn't my question. My question is: What brute ...
2
votes
2answers
99 views

my bruteforce prevention has major downsides - any ideas?

I'm currently searching for the best way to prevent my software's webportal from bruteforce attacks and came up with the following idea: 3 login attempts without any visual challenge after 3 failed ...
0
votes
2answers
130 views

Do you need more then 128bit entropy

UUID use 128 bit numbers. Currently it is not feasible to randomly produce two UUIDs that are the same. Does that means 128 bits of entropy is suitable for all cryptographic operations? I would ...
-4
votes
1answer
132 views

is there any playground for brute force? [closed]

Is there a site where i can make an account and run my brute forcer to check it for infinite attempts? Something which does a HTTP request and no javascript submit.
2
votes
2answers
67 views

Isn't ssh-copy-id exposing to a brute force attack?

It is a common knowledge, that using keys to authenticate ssh users is more secure than using passwords. However, even with password login disabled, when running ssh-copy-id I am still asked for ...
2
votes
1answer
93 views

Yii client side captcha validation

Apparently, Yii web application framework generates some kind of hash value from captcha codes it generates and sends it to the client side so it can be used for client side validation of the captcha ...
0
votes
1answer
55 views

Can an old fashioned crypt encrypted file be brute forced, if so how?

If I encrypt a file using the old Unix/Linux crypt() function, how can it be decrypted or attacked? I understand how a password file (for example) is attacked, you guess passwords, run them through ...
2
votes
2answers
169 views

How can I make wordlist smaller size?

I've been thinking if I create numeric 8chars wordlist and then compress it, can I directly input compressed wordlist into aircrack-ng or is there a way to make a smaller size wordlist, because if I ...
2
votes
3answers
122 views

Does brute forcing require a password and username list?

I have been learning metasploit. One thing I noticed was that, all the videos on YouTube, which said "Brute forcing", used a password and a username list. My question is that, won't this be called a ...
2
votes
3answers
157 views

What prevents a coder from brute forcing a wifi?

I know that a coder is able to connect to a wifi through code so my question is: Is there anything that will make it difficult to brute force a wifi password?
0
votes
1answer
96 views

Ignoring collision and (second) pre-image resistance, what makes a cryptographic hash function strong?

With regards to resistance against dictionary and brute-force attacks to "crack" hashes containing passwords, what determines the resistance of a cryptographic hash function? Since collision ...
1
vote
0answers
66 views

Connect to a wifi through code [closed]

Is there any way a person could write a software using for example C++ to connect to a wifi completely by using code?
1
vote
1answer
177 views

How to use the standard (non-dictionary) brute force attack on FTP in THC-Hydra?

In the process of attempting to secure my local LAN, I have determined that I am at little risk of a dictionary brute-force attack. This being said, a standard brute-force attack which involves ...