An attack using every possible input to attempt to produce the correct output. Typically the method of last resort when no weakness allows the use of a more restricted input set. E.g. trying all possible (or likely) passwords, in an attempt to guess the correct one.

learn more… | top users | synonyms

-1
votes
0answers
11 views

Retrieve Imation Defender Management code [on hold]

I have an imation defender hard drive that uses hardware encryption. After not using it for a while, I forgot the management code of this drive. This code is needed to reset the drive, but don't give ...
1
vote
1answer
18 views

How can SHA256-hashes as input to MD5 be revealed?

I know that you shouldn't use unsalted MD5 hashes of passwords in databases. But unfortunately, people do, see https://hashes.org/public.php. From this site I downloaded a file with passwords which ...
1
vote
1answer
51 views

Can I use John the Ripper to brute-force a password-protected flash drive?

I have a password-protected flash drive. The input window allows unlimited password attempts, but this form is not an encrypted file. Can I use John the Ripper to bruteforce the password?
1
vote
0answers
50 views

RSA-1024 vs. DSA-1024: Claim DSA SSH key is much faster to brute force

Does the brute force speed vary significantly between 1024-bit RSA and DSA SSH keys? DSA like gpu keypairs are probably DSA/Elgamal? (Can't find docs) EDIT: The reason I ask is an instructor that "...
14
votes
1answer
2k views

Understanding brute-forcing algorithms [duplicate]

I've been reading up on brute-forcing techniques and possible methods of prevention, but there is one issue that I haven't been able to find a clear answer to. The way I understand it, a 'simple' ...
1
vote
0answers
39 views

Password guessing attack on file from SSD [closed]

I got the following scenario: a SSD self-encrypting drive (to be precise: a Samsung MZ7PD256HCGM) is encrypted using McAfee full-drive encryption (Opal 2.0 standard). I have a (relatively small) file ...
1
vote
0answers
37 views

Hydra hangs after 16 attempts

When I try to brute-force my router's admin page, Hydra is never making more than 16 attempts. After 16 attacks I receive only status updates with less and less tries per minute. Beside that, all ...
0
votes
1answer
80 views

Robots trying to login to Azure VM when SSH port is closed in manager

I have many robots trying to do SSH login in a Azure VM. In the resource manager SSH is disabled but attacker IPs are public, as you can see below, where I copy a log for auth.log (I have an Ubuntu ...
0
votes
1answer
32 views

Attacking encrypted storage vs attacking memory [duplicate]

I want to create a generative password manager. Generative password managers generate passwords based on seeds such as the master password and the website's URL. In contrast, most password managers ...
1
vote
1answer
58 views

Can LastPass local password store (on a Android device) be brute forced in a usual way?

I' trying to figure out how secure LastPass is if you have it on your Android device and it gets stolen. If I'm not mistaken there has to be a password vault stored somewhere locally on the device. ...
-4
votes
1answer
83 views

How long does it take to brute force a 7 character long password taken from 16 character set

A database file is encrypted with 256bits AES and the key is the first 7 characters (from the character set 0-9, a - f, all small letter) of MD5 hash . This implies 2^28 bits (268,435,456) possible ...
3
votes
1answer
58 views

Is there value in slowing down retries on a fingerprint lock?

My phone has a fingerprint lock and it sometimes fails to identify my fingerprint (for example, if it wasn't positioned correctly). If I fail fingerprint identification 5 times in a row, I'm locked ...
36
votes
7answers
7k views

Is it possible to improve brute-force guessing of a password with a picture of the keyboard used to enter it?

Is it a bad idea to post a photo of your keyboard to social media? Can I look at a photo of a keyboard and determine the password of an account? Assuming a certain (set of) password(s) is the most ...
-5
votes
1answer
84 views

Time to break SHA-512 [closed]

From http://stackoverflow.com/questions/6776050/how-long-to-brute-force-a-salted-sha-512-hash-salt-provided, to break SHA-512 with brute force strategy, it require 3,17 * 10^64 years. It is almost ...
0
votes
0answers
38 views

Tool/Python script to generate word list [duplicate]

Is there a tool or specific Python script to performs the following to generate a word list: able to set minimum amount of letters such as 8 able to set maximum amount of letters such as 15 use ...
1
vote
0answers
53 views

How to prevent DirBuster to stop listing apache server side files

I have deployed a php project on apache. When I use DirBuster tool to scan my site, it lists all server side files. I want to stop this listing. I have modified the permission. When I give the less ...
1
vote
0answers
34 views

DVWA hydra brute not matching

I am trying to brute force DVWA on low security. I disabled the first authentification as well. However when I ran my hydra script it doesn't match it with correct password. Here is my query hydra -l ...
35
votes
8answers
4k views

Find matching phone numbers without actually knowing them

We have a mobile app that, given two users, needs to let them see what common contacts they have based on their phone numbers. How can we do this in a cryptographically secure way and respecting the ...
1
vote
3answers
180 views

How to protect WordPress from brute-force attacks?

One of my WordPress sites is being constantly attacked with brute force. I have the WordFence and Clef plugins installed. The number of login attempts is limited to just one. The password is very ...
4
votes
1answer
105 views

Spoofing an NTP server to allow bruteforce on any smartphone

We all know that smartphones (i'll take iPhone as an example) rely on SNTP/NTP servers to update a device's time and date. So, by creating an SNTP server that mimics Apple's server, we can actually ...
3
votes
3answers
116 views

Are login pages with no retry counts/lockouts a security risk?

I found a login page for a city/edu organisation that has no session times, no retry counter/lockout, and no delays if too many tries are made in a certain timeframe. I am able to exploit this to get ...
2
votes
2answers
180 views

Can You Brute Force Dropbox Folder URLs?

One can share folders with Dropbox by sending a URL with a hash in it. A recent article reported that user files were accessed by generating urls from common URL shortners. These URLs are typically ...
3
votes
1answer
91 views

Two factor brute force protection

If I implement two factor authentication using TOTP, I (obviously) have to protect against simple brute force attacks of the TOTP value. If I ask for the TOTP value after successful password login, ...
34
votes
7answers
4k views

How to know if a file is decrypted or not

For school, I have to do an exercise in which I have to decrypt files by brute force attack. There are a lot of different files in different file formats. The files have been encrypted using XOR or ...
3
votes
2answers
94 views

What scenario are 'extra' strong passwords and hashing algorithms actually protecting against?

Note: I completely understand the need for strong passwords & I understand that there is an issue of speed with hashing. I am just interested in better understanding the actual negative impact of ...
2
votes
1answer
254 views

How does attacker Brute force facebook account if there is a limit for tries? [closed]

I am wondering how does a user use Kali with python Brute Force Algorithm to brute force accounts like a facebook account when there are security measure in place like:Pause your try after 3 ...
0
votes
0answers
23 views

Cyrus-Imap (v2.3.16) local logon attack

CentOS-6.7 Cyrus-IMAP-2.3.16 The host inet07.hamilton.harte-lyne.ca is our IMAP server host. It offers imap and pop3 publicly. I uses local accounts (/etc/passwd) for imap/pop3 authentication only....
1
vote
2answers
111 views

How can we protect signup APIs from brute force registration?

This is a general question but its prompted by a fairly open API I have for a file storage service that needs to have its front door better locked down. We have an API like POST '/signup' that just ...
46
votes
7answers
9k views

How are GPUs used in brute force attacks?

I have read that GPUs can be used in brute force attacks? But how can this be done and is there a need for any other hardware devices (hard disks for instance)? Note: I'm more interested in web ...
1
vote
1answer
84 views

VPN - Why is my NAT'ed Laptop being SSH-brute-forced by External IPs when in VPN?

I am using a commercial paid licence to a VPN provider, which I use on two boxes, a FreeBSD, and a Linux BackBox. When connected to this proxy, my interface receives a public IP from the VPN ...
2
votes
2answers
141 views

How fast is it to bruteforce a 48-bit key with current technology?

Say you have a truly random hexadecimal key formatted as 1234.5678.ABCD, with 48-bit entropy. Assuming the key is stored with no hashing/salting, how fast/easy would it be to brute force it with ...
4
votes
1answer
42 views

What are the dangers of exposing weakly protected user accounts bound with a fake shell over ssh?

As anyone running a server can tell from first-hand experience, there are bots trying to constantly brute force their way through with commonly found usernames over SSH. A friend of mine created a ...
6
votes
1answer
107 views

Hydra when redirects

I'm using Hydra and I have trouble with this command: hydra 123.123.123.123 http-form-post \ "/se/login:j_username^USER^&j_password=^PASS^&submit=Log+in:/se/invalidLogin" \ -L /root/...
0
votes
2answers
289 views

Cracking a password Protected pdf file using John the ripper

What exactly happens after I provide the hash from the pdf file to John for cracking the password? Does John extract just the password hash from the file and work on it, or is there something else?
27
votes
3answers
4k views

Use multiple computers for faster brute force [duplicate]

I've watched Mr. Robot lately and can't stop thinking why it was so hard to decrypt files encrypted using AES encryption with a 256-bit key. Let us say the only method to find the key is through brute ...
19
votes
3answers
2k views

Rate limit login attempts: count by IP or username

I need to limit login attempts. One option is to count attempts by IP address and then block the IP. The disadvantage is that different users may have the same IP address. Another option is to limit ...
0
votes
0answers
35 views

What is a straightforward way to brute force CLI applications?

This is a question to maybe more CTF-experienced guys among you. I wonder how you generally brute force a simple CLI application. For example if you have an application which tells you a user's data ...
2
votes
0answers
47 views

How rf remotes for “cloning” rolling code find matching codes?

I've been tinkering with a rf (garage door) remote control that has a scanner mode (google JMA SR-48 for details). This mode works for Mutancode and Erreka which I assume would be similar to KeeLoq. ...
0
votes
1answer
194 views

Why IOS on IPhone cannot be brute-forced programatically? [duplicate]

I am interested in the recent Apple case where FBI wants to get access, but they say it's not technically possible other than creating a new OS (or I guess just modifying the existing one). More ...
0
votes
3answers
97 views

How does encryption force a processor to “pause”?

I'm often told that encryption forces processors to "make a pause" when performing the math to decrypt a hash, which is why brute forcing can take so long. I don't understand what it means for a ...
6
votes
2answers
1k views

Apple vs DOJ - how strong is the 10-try wipe brute force barrier?

Out of curiosity and with the hope of helping other beginners and journalists. The current Apple vs DOJ standoff in a nutshell - Apple is resisting DOJ with statements like what they're asking is "...
0
votes
1answer
149 views

Brute force a hard drive when most of the password is known

I need to access a hard drive that is encrypted with LUKS. The password provided is incorrect, however it is only incorrect by a character or so. The password itself is very strong and above 30 ...
82
votes
6answers
11k views

Script Kiddies - how do they find my server IP?

I've set up a site on Digital Ocean without a domain yet, so there is only the IP. Despite telling no-one of its existence or advertising it, I get hundreds of notices from fail2ban that various IP's ...
-1
votes
2answers
216 views

Is it possible to perform bruteforce attack with proxy on a website?

When one does brute force attack online, most probably the person will get caught easily,isn't there a way of doing brute force for example on a website without getting caught?
1
vote
2answers
129 views

Are password-guessing attacks a real threat?

There are tons of questions, answers, articles, papers, cartoons etc. on the subject of how to choose a password in such a way that it's difficult to guess or crack with a dictionary-based attack. I ...
1
vote
1answer
309 views

Law enforcement cracked my phone?

Police took my android phone a few months ago. It was encrypted and had the 10 max tries destruction thing set on. I noticed that yesterday the device disappeared from my android device manager. ...
1
vote
3answers
298 views

How to (further) ensure SSH security?

I set up my Linux Ubuntu machine as an SSH server through no-ip.com and it works great. Recently I discovered the command, sudo lastb -ad -F -w which outputs a log of the most recent failed SSH ...
5
votes
1answer
287 views

Blocking Chinese IP addresses

I recently checked one of my servers' auth.log file and noticed some very suspicious activity. I recently shut down my server's ssh daemon, so the logs end on Jan 22, but what I noticed after ...
27
votes
10answers
5k views

Could I recover the content of file from its checksum/hash?

Let's say I have a video file that is split into multiple parts. Each piece is 2 Megabytes. I also have a list of the *insert hash name here* for each piece and also for the full file. Now assume ...
1
vote
1answer
306 views

How to brute force HTTP Basic Authentication requested with XHR?

How can one brute force a website using HTTP Basic authentication using metasploit which uses XHR in background? I am getting error "No URI found that asks for HTTP authentication". Relevant headers ...