An attack using every possible input to attempt to produce the correct output. Typically the method of last resort when no weakness allows the use of a more restricted input set. E.g. trying all possible (or likely) passwords, in an attempt to guess the correct one.
-3
votes
2answers
142 views
Can the U.S. goverment crack encryption? [closed]
Does USA government have the sufficient processing power to crack keys in matter of seconds? Let say 2048-bit RSA, for example.
Since the RSA algorithm was developed by USA government (NSA?), I ...
1
vote
3answers
83 views
Why are MD5 collisions dangerous?
I understand that the MD5 algorithm isn't collision resistant, and that collisions between data of arbitrary size can be found with more efficient methods than brute-forcing.
However, I have read ...
-3
votes
1answer
60 views
Feasibility of brute-force on online password [closed]
I am familiar with how offline brute-force attacks work. But for online accounts, assuming no social engineering, how feasible is it to brute-force attack a password? For example, is this dependent ...
-2
votes
1answer
109 views
How long does it take to crack a 100-letter long winrar password? [closed]
i´m interested in how long time it would take for a super computer dedicated to crack
to crack a 100-letter long winrar password. The password contains Lowercase, Uppercase, Digits, ...
7
votes
1answer
138 views
Why does Hydra return 16 valid passwords when none are valid?
I've been playing around with Hydra and DVWA and I've hit a bit of a snag - Hydra responds letting me know that the first 16 passwords in my password list are correct when none of them are.
I assume ...
6
votes
3answers
156 views
Can I spoof IP addresses when attempting to brute force a login?
I am testing my website with hydra brute-force software. But accessing my apache conf remote server file, it seems that an attacker can't log-in more a limited number of times per seconds. Does hydra ...
-3
votes
0answers
144 views
Truecrypt Bruteforce, dictionary atack [closed]
I forgot my Truecrypt password, so I'm trying to recover it by doing a dictionary attack on my encrypted HDD. I know my password is built out of six parts, which have about 3-30 different ...
0
votes
0answers
28 views
How can I determine the encryption used by knowing input and result? [duplicate]
Is it possible to determine the encryption or hash used if I know the original input and final output? There is a similar post here: Determine encoding/hashing methods used based on knowing the input ...
3
votes
2answers
171 views
Estimated cost to make a brute-force WPA2 attack feasible
It's been shown that a brute-force attack on WPA2-Personal is possible in a reasonable amount of time. These successful attacks appear to be limited, however, to researchers who have the budget to ...
4
votes
1answer
130 views
WPA2 audit tool
For the purposes of my own research, I have a very modest budget to set up a modest WPA2 brute-forcer supported by GPU(s).
I've done some homework:
Brute-Force GPU Password Crackers
How to setup ...
2
votes
1answer
230 views
Brute-Force GPU Password Crackers
Brute-force password cracker programs which claim GPU support include John the Ripper, ighashgpu, oclHashcat, and others. oclHashcat appears one of the more popular, but I am not sure which AMD/ATI ...
4
votes
2answers
109 views
Do SSD's offer significant performance boost for Scrypt?
Being a memory intensive hash, I was wondering if SSD's offer any appreciable performance boost for brute force attacks.
0
votes
2answers
155 views
Bruteforce Passphrase of Dictionary Words
Consider the all lowercase passphrase:
"lazy fox haggles treaty"
Assume all four words are in a dictionary of 2000.
Bruteforcing word combinations, how long does it take to crack this password at ...
2
votes
1answer
508 views
Bruteforce on 10 characters length WPA2 password
I'm trying to hack my own WPA2 network for learning purposes.
I have the *.cap file generated by aircrack-ng tools after a WPA handshake.
I've tested by including my own password and a bunch of ...
4
votes
1answer
86 views
Could a password hash that's prone to more collisions provide better overall security?
Website security breaches seem to be a common occurrence, giving the attacker password hashes that he can conduct a brute force attack against, often given him a list of passwords that will work on ...
1
vote
2answers
227 views
Avoiding Brute Force Attacks in a Web Based Login Form
My login form uses Ajax so it doesn't need to reload if the password is wrong. A PHP script process the request and creates the session if the credentials are right. My idea is to have the PHP script ...
-4
votes
3answers
468 views
How long will it take to crack a 10-15 character winrar password? [closed]
Ok, long story short, I'm currious how long it would take an agency to crack a 10-15 character winrar password. The file names in the archive are also scrambled including a word at the start and ...
3
votes
2answers
164 views
Web & insecure HTTP - Using RSA for encrypting passwords on the client side
I used client side password hashing in my register and login project.
Its purpose is to prevent passive adversaries/eavesdroppers from discovering users' plaintext passwords when HTTP requests are in ...
2
votes
1answer
143 views
How large RSA-keys could the worlds combined computer power factorize in reasonable time?
If you combined every microprocessor on earth into one humongous computational cluster, how large RSA-keys could you factor in reasonable time (lets say a few years)?
I know from reading the answers ...
8
votes
1answer
150 views
What's an attack's 'computational complexity'?
I'm writing a business-language report about MD5. In my search a found a paper by Yu Sasaki and Kazumaro Aoki explaining their 2123.4 pre-image attack on MD5.
I know that it has something to do with ...
1
vote
1answer
86 views
Botnet Attempting to Login to Website
Our server has recently become a target of what appears to be a botnet attack. The first indication was an insane amount of traffic to one of our client's websites - so heavy that the server entirely ...
1
vote
1answer
209 views
Use brute force to mitigate brute force
Just an idea I had, and I am sure there is a lot of material about this subject, so I am looking for a pointer as to where I can find more information.
My idea is this...
When storing a password in ...
5
votes
2answers
113 views
NTLMv2 resistance to bruteforcing
I have a question regarding NTLMv2 resistance to password bruteforcing.
I know that some modern graphic processors (like Radeon 6990) are able to calculate billions hashes per second and crack NTLM ...
2
votes
1answer
553 views
How long it will take to crack a RAR password?
I wonder how long it will take to crack 16 character alphanumeric WinRAR password for a mini supercomputer. As far as I know graphic cards are preferred over CPUs to crack passwords nowadays. If we ...
2
votes
2answers
145 views
How can i calculate the number of possible passwords?
I have found a flaw in a site where the password reset feature resets passwords in the following format
UpperCaseLetter-Number-LowerCaseLetter-Number-LowerCaseLetter-Number-UpperCaseLetter
...
11
votes
2answers
310 views
Zip file with two password
I used this command to password protect a zip file on Linux :
zip -P 9000 hash.zip hash.py
and it creates the zip file just fine, then I wrote a program to test every possible password on it from 1 ...
1
vote
1answer
190 views
Brute Forcing Domain Controller
I have a MS-Server2K3 domain controller that also serves as a Exchange server. Due to recent network speed loss and issues I began looking at event logs and noticed an exceptionally large number of ...
10
votes
2answers
2k views
Why are GPUs so good at cracking passwords?
What is it about GPUs that lets them crack passwords so quickly?
It seems like the driving force behind adopting good key-derivation functions for passwords (bcrpyt, PBKDF2, scrypt) instead of ...
2
votes
1answer
113 views
Pointers for john the ripper rulesets
I've been pouring over the JtR ruleset documentation and making little progress. I understand how to use it to make various permutations from a given wordlist, that's fine. However, I'm trying to ...
1
vote
2answers
232 views
Password Protected Zip: if attacker had one file, can use it to decrypt all files?
Consider a folder containing the following files:
(file1.txt, file2.doc, file3.pdf) all zipped and password protected, if attacker had one of these file, can use it for decrypting all without knowing ...
4
votes
3answers
135 views
Hashing a key: less entropy than the key itself
A web API needs to store a 'key' for authentication, in much the same fashion as a password but at 128 characters. My concern is that the salted SHA1 hash for the key has less entropy than the key ...
4
votes
1answer
202 views
Securing a simple webservice against brute-force with mod-security
I want to provide basic defense against brute-force attacks against a simple HTTPS web service. The web service provides a login method (let's say at http://example.org/login) which gets passed a ...
1
vote
2answers
221 views
Brute force a GUI login?
I know I have read somewhere that the reason the UAC prompt in Windows 7 was employed is that viruses that would supposedly execute privileged instructions won't be able to "click" the confirm button ...
9
votes
3answers
1k views
Cracking MS-CACHE v2 hashes using GPU
As most people here will know, Windows caches domain/AD credentials in a format known as MS-Cache v2. Obviously, these would be excellent passwords to gain during a penetration test when local access ...
4
votes
1answer
1k views
Brute Forcing Password to a Truecrypt-encrypted file with Partial Knowledge
A while back, I encrypted a few files with Truecrypt, and stored the password in my head. Now I need to access it again, the password isn't working. I'm sure most of it is right, but I'm off by one or ...
4
votes
4answers
320 views
Insecure to require numbers in passwords?
Earlier, I went to a site that required a number and special character, and it got me thinking – wouldn't that make the password easier to brute force? If you assume most passwords have around 12 ...
1
vote
4answers
267 views
Our logs showing a lot of SSH brute force attacks originating on Port 11
this forum has been brilliant so far. Just wondering if I can get a bit more help:
Can I get some info on a large amount of SSH brute force attacks originating from port 11 on the external host over ...
2
votes
2answers
150 views
Slow down symetric encryption
I'm developing a program in Java. In one step data should be encrypted and exported in a file.
As of now we are encrypting in AES-256
I want to slow down a possible brute force attack as much as ...
-1
votes
1answer
44 views
Automated post request [closed]
I'd like to write a script to test my site by means of automated post request to login password inputs. Can I use Brutus software ? Where can I find some script's source code from which to inspire ?
3
votes
4answers
458 views
Finding all links under a website
How can i find all directories and links under a website? Note that there is no link from home page to all other pages. For example if i have a domain like this users.company.com and each user will ...
3
votes
2answers
203 views
is it easier to get the original password if you have multiple hashes of it?
Most users tipically use the same password for multiple applications. Let's say all of these applications hash the password in some way. Would it be easier for an attacker to get the original password ...
3
votes
0answers
275 views
Can an attacker guess my password length from a hash? [duplicate]
Possible Duplicate:
Possible to detect password length from hash? Is doubling your password adds more security?
Considering I do not provide him any personal information relating to it, are ...
1
vote
4answers
271 views
How unlikely is it that a Google Doc link is guessed?
Most (if not all) of us know that a Google Doc link looks something like this:
https://docs.google.com/document/d/13P3p5bA3lslqEJT1BGeTL1L5ZrQq_fSov_56jT9vf0I/edit
There are becoming several tools ...
12
votes
4answers
679 views
Attract Brute Force SSH Attacks
I posted a question on Server Fault, but got downvoted and had the question closed.
One of the comments suggested looking over here, so here goes:
For my senior project, I'm working on an ...
1
vote
2answers
209 views
Can you crack a Mailinator “Alternate Inbox Name?”
From their FAQ:
What are "Alternate Inbox Names" ?
There are 2 ways to get email into any given inbox. When you check an inbox, listed at the top is the Alternate Inbox name. Emailing that alternate ...
4
votes
1answer
408 views
Brute force login attempt from spoofed IP's
I see that many of my WordPress installs are being hit with 1000+ failed login attempts using non-existing 'admin' account name. The requests come from different IP's every time, and I see IP's such ...
1
vote
1answer
328 views
Failed RDP brute force attack from Microsoft IP address?
I use RDPGuard on my webserver. I have noticed that it blocked an IP address which seemed to originate from a Microsoft registered IP address:
Process Information:
Caller Process ID: 0xf78
Caller ...
-2
votes
2answers
2k views
What are the methods to crack WPA and WPA2? [closed]
Is there any method other than brute force and dictionary attacks to break WPA and WPA2?
3
votes
2answers
4k views
How to setup GPU for Cracking WPA/WPA2?
I have a Dell N5110 15R Laptop that I'm planning to use for GPU based cracking of WPA/WPA2 passwords. The thing is, I'm not a really big fan of password dictionaries and rainbow tables, I'd rather ...
14
votes
8answers
564 views
Bruteforce vs Denial of Service
I had a problem presented today which I found quite interesting.
You have an application with a management panel. You know some of the accounts as they are standard. You want two things:
You want ...
