An attack using every possible input to attempt to produce the correct output. Typically the method of last resort when no weakness allows the use of a more restricted input set. E.g. trying all possible (or likely) passwords, in an attempt to guess the correct one.

learn more… | top users | synonyms

0
votes
1answer
1k views

Cracking a web form based logon with hydra [closed]

How do I have to use hydra on a web form? What I have done so far: I already successfully used hydra on a folder with an HTTP authentication: http://localhost/test/authtest/ with user admin and ...
3
votes
3answers
130 views

Is login limiting still needed if we employ multi-factor authentication?

The status quo is that most online websites limit login attempts per IP address, or even per account since some attackers possess huge amounts of IP addresses. OWASP declares: When multi-factor ...
1
vote
1answer
480 views

Hydra gives wrong passwords

I've been trying to use hydra (educational way) but with no success. The site method is http-post but performed by ajax (should it be a problem? I think not). After execute the command I got an output ...
12
votes
1answer
353 views

What's an attack's 'computational complexity'?

I'm writing a business-language report about MD5. In my search a found a paper by Yu Sasaki and Kazumaro Aoki explaining their 2123.4 pre-image attack on MD5. I know that it has something to do with ...
3
votes
4answers
306 views

Ethical brute force demo on a web login when knowing the password complexity requirements

We are currently having accounts compromised at a substantially high rate. Some in the organization believe that our password complexity requirements is enough to thwart brute force attacks. I wanted ...
0
votes
0answers
56 views

My server has been brute forced what now? [duplicate]

I have installed a raspberry pi for fun at home. I opened the port 22 and this morning I was concerned about someone brute forcing my server. I ran this query : cd /var/log;zgrep ssh auth*|grep ...
1
vote
3answers
146 views

Touch tone phone username and password

I just got off the phone with Fidelity, who manage the health benefits for the company where I work. Before talking to a person, I was prompted to enter my username and password on the numeric keypad: ...
19
votes
2answers
11k views

Why are GPUs so good at cracking passwords?

What is it about GPUs that lets them crack passwords so quickly? It seems like the driving force behind adopting good key-derivation functions for passwords (bcrpyt, PBKDF2, scrypt) instead of ...
1
vote
2answers
685 views

Can you crack a Mailinator “Alternate Inbox Name?”

From their FAQ: What are "Alternate Inbox Names" ? There are 2 ways to get email into any given inbox. When you check an inbox, listed at the top is the Alternate Inbox name. Emailing that alternate ...
0
votes
1answer
60 views

Find hash-function if original and hash are given? [duplicate]

I was thinking whether or not you can find the hash function(s) used if you have the original message and the hash. So assume that no salt is used during the hashing process, just multiple hashing and ...
1
vote
1answer
243 views

How do we estimate the time taken to crack a hash using brute force techniques

A German hacker famously managed to brute force crack a 160 bit SHA1 hash with passwords between 1 to 6 digits in 49 minutes. Now keeping everything constant (hardware, cracking technique - here ...
2
votes
1answer
640 views

Hydra bruteforce and JSON

I am having problems with Hydra and a JSON payload. The login request (intercepted with Fiddler), is the following: POST http://architectureservice.test.com/api/v1/login HTTP/1.1 Host: ...
3
votes
4answers
585 views

Can I brute-force a password hash even if I don't know the hash-algorithm used?

Can I brute-force a password hash even if I don't know the underlying algorithm? For example if I get hold of a database with password hashes and the used hash algorithm is unknown, like a random ...
12
votes
4answers
524 views

How should I secure a contact form that appears on every page of a website?

My client has a small "Contact Us" form on every page of their website. They are adamant about not including CAPTCHA verification on these forms, to keep them easy to use, but I feel it is my ...
59
votes
8answers
97k views

Where can I find good dictionaries for dictionary attacks?

I’m wondering where I can find good collections of dictionaries which can be used for dictionary attacks? I've found some through Google, but I’m interested in hearing about where you get your ...
0
votes
0answers
300 views

Testing Basic Authentication with ncrack

I'm conducting some basic pen testing against a page protected with Basic Authentication. I've sucessfully tested with Medusa and Hydra but am struggling to get the syntax correct for ncrack. the ...
11
votes
2answers
9k views

Why does Hydra return 16 valid passwords when none are valid?

I've been playing around with Hydra and DVWA and I've hit a bit of a snag - Hydra responds letting me know that the first 16 passwords in my password list are correct when none of them are. I assume ...
30
votes
2answers
37k views

How to estimate the time needed to crack RSA encryption?

How to estimate the time needed to crack RSA encryption? I mean the time needed to crack Rsa encryption with key length of 1024, 2048, 3072, 4096, 5120, 6144, 5120, 7168, 8192, 9216, 10240, 11264, ...
4
votes
4answers
476 views

Can't brute force password cracking somehow be throttled?

Online articles mention the importance of a strong password and suggest that hacking tools allows bad guys to attempt millions of passwords per second. I am wondering why OSes and websites and such ...
1
vote
2answers
193 views

How to make an efficient bruteforce attack on Windows? [closed]

I've been trying to figure out a way to efficiently bruteforce on Windows, but the method I currently have isn't very efficient. I did some profiling and found out that on average it can go through ...
1
vote
0answers
553 views

Brute-Force/Dictionary attack against encypted file using PBKDF2 key derivation

I have been following this very useful post by Thomas. My use case is slightly different. I am developing a mobile application which requires some sensitive data to be stored on the device in a SQLite ...
6
votes
1answer
378 views

Harden a server against mass SSH DoS attacks

How can a Linux server be protected against an attacker that tries to open a large number of SSH sessions (probably trying to brute force a password) that no ports remain to be able to legitimately ...
1
vote
1answer
125 views

Can Hydra crack a flash-based login?

Is it possible to brute force a flash login with hydra? If not, what is a good tool to pen test a flash login?
1
vote
1answer
143 views

Is there an equation to calculate the number of instances of a series of characters exist in a given key space?

If I'm using 16-18 character-length passwords with 94 different possible values-per-character (lower alphas, upper alphas, numbers, and special characters), is there an equation I can use to calculate ...
-3
votes
1answer
52 views

How many possible symbols and punctuations in a password? [closed]

I want to compute the possible combinations of a password consists of 8 digits of: alphabetical letters (26), numbers (0-9), symbols and punctuations. In order to compute this, I have to know the ...
21
votes
5answers
3k views

Do non-keyboard characters make my password less susceptible to brute forcing?

I can put characters in my password for which there are no keys on a keyboard. On Windows, Alt+#### (with the numpad) inserts the character for whatever code you type in. When I put this in a ...
3
votes
2answers
19k views

Remove Password Protection from XLS Document

Similar to what is listed here, http://datapigtechnologies.com/blog/index.php/hack-into-a-protected-excel-2007-or-2010-workbook/, is there a way to remove the password from an XLS (Excel 2003) ...
2
votes
3answers
41k views

Wordlists on Kali Linux?

I notice that in /usr/share/wordlists in Kali Linux (former Backtrack) there are some lists. Are they used to bruteforce something? Is there specific list for specific kind of attacks?
3
votes
1answer
166 views

Better than brute-force way to find the “lowest” sha1 hash?

While pointing out a SQL injection flaw on another question, I was able to show that an arbitrary sha1 hash could be inserted into a query such that it would be taken for a real hash, and was ...
1
vote
1answer
121 views

Username Enumeration as a Threat

I have found a Username Enumeration Vulnerability through which I am able to determine whether a particular user is registered with that site. While trying to brute force, after 5 attempts it asks for ...
5
votes
3answers
2k views

What are the odds of brute-forcing an archive with 256-bit encryption?

I have a file (a stand-alone archive). I lost the password to it, but it has been encrypted using 256-bit encryption. The password is some 20-odd characters long (including non-alphanumeric ...
2
votes
1answer
134 views

Given a hash, salt, charset and password length, how do you get the password without brute-forcing it?

I got that question on an exercise and I'm not sure what to answer. Without conventional brute-forcing and without a rainbow table, how could I find out the password? An improved brute-force ...
0
votes
2answers
94 views

How do you overcome the problem of the salt being public and known by the attacker? [duplicate]

I believe that when adding a salt to the password you need to store the values so you can compute the hash again. But, what does happen if the attacker get the salt? How is it possible to add value ...
0
votes
1answer
44 views

Does restarting an encrypted session increase security and deter attacks?

When a user initiates a SSH connection for example, keys are exchanged and a session is established with a new "passphrase" each time. If an attacker were to attempt to brute force this connection, ...
20
votes
10answers
4k views

Best password strength checker

In XKCD #936: Short complex password, or long dictionary passphrase? Jeff claimed that password cracking with "dictionary words separated by spaces", or "a complete sentence with punctuation", or ...
11
votes
1answer
14k views

Brute Forcing Password to a Truecrypt-encrypted file with Partial Knowledge

A while back, I encrypted a few files with Truecrypt, and stored the password in my head. Now I need to access it again, the password isn't working. I'm sure most of it is right, but I'm off by one or ...
1
vote
1answer
4k views

Forgot password to 7-Zip archive

I think I already know the answer to this question, but I thought I'd ask the experts anyway. A few months back, I created a password-protected 7-Zip archive which housed the source code of a simple ...
0
votes
1answer
59 views

Is encryption less resistant to brute-forcing compared to hashing?

I understand that a hashing algorithm like bcrypt uses several rounds of hashing to make it computationally expensive for a brute-force attack. How does encryption work against a brute-force attack? I ...
3
votes
3answers
260 views

Could using a generated key from an online service be considered a risk?

With some colleagues we're having a debate regarding the randomkeygen.com website. I do think that there is a security risk using the generated keys of this (or any of this kind) website. Why ? ...
1
vote
2answers
190 views

How do you know if blowfish key is correct?

Encryption novice here so maybe this question makes no sense... Obviously if you know what the clear text is and it decrypts right, you have it. But if someone is running through keys to break the ...
8
votes
8answers
2k views

With which algorithm I can prevent a brute force on a login?

I want make my software more secure. I want prevent it from brute force attack. I know that a strong password is the best but I can not control it. The algorithm must scale from a very small system ...
0
votes
1answer
92 views

What is the best way to generate a password/pin like string using brute force method? [closed]

I have a string of 7 characters. I'm supposed to generate all the combinations. But some combinations are more likely than others, I would like the more likely ones to be generated first. If I ...
1
vote
0answers
3k views

Linux Hydra issue - random correct password success

I have an issue with Hydra when i use it. First let me inform that, i read multible guides, tries the excact same command lines as in guides directly supported by the Damn Vulnerable Web Application ...
1
vote
0answers
2k views

BruteForce on Hydra (Usernames or Password with Special-Chars), letter “Ñ”

I use Hydra with the Web-Form (Http-Post-Form); and I'm trying to use a list of Usernames when some of the nicks contain a letter ñ. For example I have the following account in my list: Username: ...
15
votes
3answers
2k views

Why check to see if a password is already used by another user?

This is coming from a joke originally in French: Enter your password. carrot Sorry, your password must be more than 8 characters. carottegéante (giant carrot) Sorry, your ...
1
vote
1answer
1k views

How many possibilities can today's computers check (per second) in a SHA512 hash of a 50-byte-long random entry? [closed]

The problem I want to avoid is "brute force" attacks against a database. So if I add a 50-byte-long cryptographically random salt to my information (which I don't need to retrieve, just its hash) - is ...
-1
votes
1answer
2k views

Hydra bruteforce is giving wrong passwords. Can't seem to work any help? [closed]

Ok so what im actually trying to do is to bruteforce my own account on some website just to check myself . This is NOT for illegal steps or use , im trying to crack my OWN password , and im trying to ...
1
vote
1answer
162 views

What is the strength of the key derivation function on Android device encryption?

What is is strength of the key derivation? Specifically, how many milliseconds or microseconds would it take a desktop computer to check a guessed password to see if it is a match? I am aware this ...
4
votes
3answers
214 views

Is there any reason in particular encryption keys aren't arbitrarily large?

It's my understanding that the more bits an encryption key has, the longer it takes to break the encryption. What is the down side of having a larger encryption key or why don't we see keys of size ...
0
votes
1answer
149 views

How can brute force scripts tell once they're found the correct key?

If you have a random block of data and you encrypt it with a key, how can a brute force script tell when it has found the correct key? Is it possible without some sort of reference to the original ...