An attack using every possible input to attempt to produce the correct output. Typically the method of last resort when no weakness allows the use of a more restricted input set. E.g. trying all possible (or likely) passwords, in an attempt to guess the correct one.
17
votes
5answers
1k views
What's the practical limit for rainbow-table based bruteforce?
Say we have a hash of a password. The password can be considered to be made of of totally random characters and has a fixed length of N. The hash is SHA1(password+salt), where the salt is of length M. ...
30
votes
7answers
21k views
Where can I find good dictionaries for dictionary attacks?
I’m wondering where I can find good collections of dictionaries which can be used for dictionary attacks?
I've found some through Google, but I’m interested in hearing about where you get your ...
16
votes
2answers
12k views
How to estimate the time needed to crack RSA encryption?
How to estimate the time needed to crack RSA encryption? I mean the time needed to crack Rsa encryption with key length of 1024, 2048, 3072, 4096, 5120, 6144, 5120, 7168, 8192, 9216, 10240, 11264, ...
16
votes
5answers
1k views
Do non-keyboard characters make my password less susceptible to brute forcing?
I can put characters in my password for which there are no keys on a keyboard. On Windows, Alt+#### (with the numpad) inserts the character for whatever code you type in.
When I put this in a ...
18
votes
4answers
4k views
how long does it take to actually generate rainbow tables?
I've been reading up about rainbow tables as I think they're quite interesting cause they're actually a pretty simple concept.
Anyway, I was wondering, has anyone been involved in actually generating ...
12
votes
2answers
510 views
Are there some good papers (or discussions) on using Markov chains or Hidden Markov Models for password auditing/cracking?
As a programmer and language enthusiast I've been very interested in Markov chains for some time. Considering the influence of natural language on password and passphrase selection (by humans of ...
10
votes
6answers
4k views
Invalid users trying to log in to my server
Im getting a lot of log attempts from unknown IP addresses and and this is happening every minute, I am using private and public keys to log in with SSH.
I have noticed that even with private and ...
3
votes
2answers
138 views
Web & insecure HTTP - Using RSA for encrypting passwords on the client side
I used client side password hashing in my register and login project.
Its purpose is to prevent passive adversaries/eavesdroppers from discovering users' plaintext passwords when HTTP requests are in ...
3
votes
1answer
3k views
Is my router vulnerable if WPS is enabled but WPS pin code is disabled?
I was reading about Reaver and wi-fi protected setups (WPS).
In my Netgear router I have the option to disable the WPS pin code, but still have the WPS push button enabled. Am I secured with such ...
23
votes
4answers
8k views
Are salted SHA-256/512 hashes still safe if the hashes and their salts are exposed?
Scenario: a database of hashed and and salted passwords, including salts for each password, is stolen by a malicious user. Passwords are 6-10 chars long and chosen by non-technical users.
Can this ...
13
votes
8answers
550 views
Bruteforce vs Denial of Service
I had a problem presented today which I found quite interesting.
You have an application with a management panel. You know some of the accounts as they are standard. You want two things:
You want ...
7
votes
8answers
1k views
With which algorithm I can prevent a brute force on a login?
I want make my software more secure. I want prevent it from brute force attack. I know that a strong password is the best but I can not control it.
The algorithm must scale from a very small system ...
6
votes
4answers
908 views
Password entropy in layman's terms
Entropy is a term used often in relation to password security and brute-force attacks, but it is a topic that can get complicated quickly. What is the best way to describe password entropy (what it is ...
8
votes
3answers
1k views
time to crack file-encryption password - more than just iteration
I have often seen that takes x amount of time to crack a certain length password. But this just seems to be the amount of time it takes to iterate through all the possibilities. What about the time it ...
5
votes
3answers
649 views
Attack vectors for brute-forcing website passwords
When talking about password security, a lot of discussion centers on the risk of a password being guessed in a brute-force attack. For websites where a user has registered an account, what are the ...
5
votes
4answers
3k views
Brute force vs other methods of recovering passwords from shadow file
Do you know any good approach for de-hashing/actually bruteforcing hashed passwords in the shadow file?
On various operating systems, any good solutions/methods/programs.
Or is it better to upload ...
4
votes
4answers
1k views
Are there lists of most common words or ngrams used in passwords and passphrases?
I've been thinking about ways to focus brute forcing dictionary attacks on passwords and passphrases based on the assumption that certain words, combinations of letters, and combinations of words are ...
3
votes
1answer
303 views
Non English password dictionaries
What is a good resource for wordlists used in auditing passwords in non english languages. I have extensive wordlists in English ranging to several GB's, but can't find similar resources for other ...
2
votes
1answer
12k views
How long to brute-force WPA password?
Bob has a password (for his WPA encrypted wifi) which is 8 characters, all lowercase, and not a dictionary word.
Eve lives next door to Bob and wants to illegally hack his WPA. The number of ...
10
votes
4answers
400 views
Are there state-of-the-art techniques or theory specifically for attacking passphrases over passwords?
With passphrases becoming more and more common based on length being more important than complexity, I'm assuming there must be some work going on involving techniques aimed specifically at cracking / ...
5
votes
1answer
118 views
General purpose slow/unique hash routine for dup checking of private data, without storing the data itself?
I am wondering if there is a percentage of uniqueness known to be lost with every repeat of various hash routines, like MD5, SHA1, and how that might compare with other algorithms.
If theoretically I ...
4
votes
4answers
705 views
Brute-force heuristics used in password cracking
Existing questions on this site discuss some of the heuristics used by password cracking tools to avoid doing a completely naive brute-force search (for example, "dictionary word with number ...
1
vote
4answers
248 views
How unlikely is it that a Google Doc link is guessed?
Most (if not all) of us know that a Google Doc link looks something like this:
https://docs.google.com/document/d/13P3p5bA3lslqEJT1BGeTL1L5ZrQq_fSov_56jT9vf0I/edit
There are becoming several tools ...
1
vote
3answers
592 views
What utilities exist to brute force a username and password?
I'm trying to persuade management to purchase two factor authentication for securing VPN and terminal server access.
I've made significant progress by demoing TSGrinder, but would like to list other ...
