An attack using every possible input to attempt to produce the correct output. Typically the method of last resort when no weakness allows the use of a more restricted input set. E.g. trying all possible (or likely) passwords, in an attempt to guess the correct one.

learn more… | top users | synonyms

1
vote
1answer
165 views

SSH Key vs Complex Password with Fail2Ban & Two Factor Authentication

Normally you hear that using an SSH Key is far more secure than using a regular password. However I've been wondering if this statement is really true. Let's say we have the following variables for ...
20
votes
7answers
3k views

Are reCAPTCHA enough to prevent brute-force password guesses?

I was wondering if reCAPTCHA were strong enough to prevent BruteForce from bots or if I needed to add more security, such as sending a unique mail to the user every 5 tries that someone try to log on ...
7
votes
2answers
208 views

Is lack of wildcard DNS entry a security vulnerability?

A friend of a friend received an email from a security researcher that looks legit. Researcher submitted several vulnerabilities, one of the them reads like this Vulnerability # ... Title : ...
-2
votes
1answer
205 views

Can someone bruteforce my OSX? (Macbook)

Is it possible for someone to bruteforce or perform a dictionary attack on a Macbook? It's very easy to bypass security of a Windows box (Password Protection) , what is the difficulty level of ...
9
votes
4answers
136k views

Wordlists on Kali Linux?

I notice that in /usr/share/wordlists in Kali Linux (former Backtrack) there are some lists. Are they used to bruteforce something? Is there specific list for specific kind of attacks?
1
vote
3answers
469 views

Adequate prevention of distributed brute force attacks?

What are good ways to prevent distributed brute force attacks on my website? I think (not sure. if someone can assure me, thanks!) my site is secure against normal brute force attacks as I am using ...
0
votes
0answers
110 views

Hydra command for cracking a webpage which uses <span> tag for failed login attempts

I'm trying to for crack a simple webform for testing hydra in Kali. When the webpage encounters a wrong username and password combination it pops up a message using the following html code:: <tr&...
0
votes
1answer
238 views

ISP has informed us that our server is launching brute force attacks on WordPress sites, how do we end this? [duplicate]

Misc Situation: -Server login is obtained by hacker, hacker places malicious brute force file in /hacked/bruteforce/ -Server password is then changed, hacker can still run script by navigating to ...
1
vote
1answer
136 views

How effective are firewall rate limiting rules for slowing down brute force and DOS attacks?

I am investigating methods to slow down the rate at which attackers can make brute force attempts against my webserver's SSH and HTTP services. I have come across many articles as well as the iptables-...
1
vote
0answers
95 views

How secure is Asus router latest framework function: “Added protection mechanism for GUI login brute-force attack for login username and password.”?

I have just updated my RT-N12 D1 router to the latest framework, and it has new function - "Added protection mechanism for GUI login brute-force attack for login username and password.". I Googled and ...
2
votes
2answers
201 views

Why do websites force the user to use a long and complicated password when brute force isn't possible?

if you have a phone with 4-digit pin and the phone does not get locked no matter how many times you put the wrong pin it makes sense to use 10 or 16 digits as it'll increase the time the attacker ...
3
votes
2answers
7k views

How long it will take to crack a RAR password?

I wonder how long it will take to crack 16 character alphanumeric WinRAR password for a mini supercomputer. As far as I know graphic cards are preferred over CPUs to crack passwords nowadays. If we ...
2
votes
2answers
453 views

How can I make wordlist smaller size?

I've been thinking if I create numeric 8chars wordlist and then compress it, can I directly input compressed wordlist into aircrack-ng or is there a way to make a smaller size wordlist, because if I ...
5
votes
3answers
364 views

Can using emojis make someone's password safer?

I was just thinking about this the other day, after reading about making safe passwords, you have a few options: The first would be, adding numbers, or something other than just a word ...
9
votes
5answers
72k views

Bruteforce on 10 characters length WPA2 password

I'm trying to hack my own WPA2 network for learning purposes. I have the *.cap file generated by aircrack-ng tools after a WPA handshake. I've tested by including my own password and a bunch of ...
2
votes
2answers
124 views

REST Services: Limiting the concurrency of a login endpoint

Scenario: A botnet is recruited to try to authenticate against a website or service with each bot trying infrequently using a common password and a list of 'real' email addresses, avoiding the ...
2
votes
1answer
290 views

Bruteforcing an iOS PIN

The iOS Security document describes several security mechanisms implemented in iOS 9. I am specifically interested in the actual security of a 4 digits PIN on iOS. I am looking for tangible ...
3
votes
2answers
33k views

Remove Password Protection from XLS Document

Similar to what is listed here, http://datapigtechnologies.com/blog/index.php/hack-into-a-protected-excel-2007-or-2010-workbook/, is there a way to remove the password from an XLS (Excel 2003) ...
1
vote
2answers
669 views

What would be the most efficient way of brute forcing a wifi key [duplicate]

I was wondering how can a brut force of my wifi be prevented so I want to know the best technique that can be used to brute force it first, so protection isn't my question. My question is: What brute ...
2
votes
2answers
103 views

my bruteforce prevention has major downsides - any ideas?

I'm currently searching for the best way to prevent my software's webportal from bruteforce attacks and came up with the following idea: 3 login attempts without any visual challenge after 3 failed ...
2
votes
2answers
340 views

Do you need more then 128bit entropy

UUID use 128 bit numbers. Currently it is not feasible to randomly produce two UUIDs that are the same. Does that means 128 bits of entropy is suitable for all cryptographic operations? I would ...
-4
votes
1answer
178 views

is there any playground for brute force? [closed]

Is there a site where i can make an account and run my brute forcer to check it for infinite attempts? Something which does a HTTP request and no javascript submit.
2
votes
2answers
82 views

Isn't ssh-copy-id exposing to a brute force attack?

It is a common knowledge, that using keys to authenticate ssh users is more secure than using passwords. However, even with password login disabled, when running ssh-copy-id I am still asked for user'...
0
votes
1answer
70 views

Can an old fashioned crypt encrypted file be brute forced, if so how?

If I encrypt a file using the old Unix/Linux crypt() function, how can it be decrypted or attacked? I understand how a password file (for example) is attacked, you guess passwords, run them through ...
2
votes
3answers
169 views

What prevents a coder from brute forcing a wifi?

I know that a coder is able to connect to a wifi through code so my question is: Is there anything that will make it difficult to brute force a wifi password?
2
votes
3answers
165 views

Does brute forcing require a password and username list?

I have been learning metasploit. One thing I noticed was that, all the videos on YouTube, which said "Brute forcing", used a password and a username list. My question is that, won't this be called a ...
0
votes
1answer
136 views

Ignoring collision and (second) pre-image resistance, what makes a cryptographic hash function strong?

With regards to resistance against dictionary and brute-force attacks to "crack" hashes containing passwords, what determines the resistance of a cryptographic hash function? Since collision ...
16
votes
5answers
3k views

What is the difference between login throttling and temporary account lockout?

I am currently working on the redesign of a login page. I have initially suggested that login be throttled whereby pauses (incremental - in number of seconds) are introduced between each failed login ...
1
vote
0answers
91 views

Connect to a wifi through code [closed]

Is there any way a person could write a software using for example C++ to connect to a wifi completely by using code?
1
vote
1answer
574 views

How to use the standard (non-dictionary) brute force attack on FTP in THC-Hydra?

In the process of attempting to secure my local LAN, I have determined that I am at little risk of a dictionary brute-force attack. This being said, a standard brute-force attack which involves ...
3
votes
4answers
1k views

One-Time-Passwords resist against bruteforce attacks? Immune Alternative?

Does a One-Time-Password like Google Authenticator or YubiKey protect against brute force attacks with unlimited computer power? If not, what algorithems are immune to bruteforce attacks against ...
1
vote
3answers
123 views

How to protect from DoS on get method?

Suppose I have a website and I want to make sure that a hacker isn't making my server down by utilising a DDOS attack on my website. I thought of getting IP address and revoking the access, but it ...
2
votes
3answers
200 views

Feasibility of time-based database brute-force attacks on websites

I recently learned that there is an attack that utilizes the fact that when brute-forcing a compared string (e.g. hash from a password or token) in a database the query fails a few nanoseconds earlier ...
5
votes
1answer
153 views

Random padding in hash functions

In this answer, it was recommended that you add random padding when hashing messages for a trusted timestamp, such as for predictions, in order to avoid dictionary and brute force attacks (at least ...
3
votes
1answer
233 views

Writing your own John the Ripper module

I have a script in C, which is able to determine the password of certain data. It uses HMAC and RC4 algorithms to encrypt the given password and then compares that later to the given data. If they ...
20
votes
4answers
5k views

Would allowing shorter passwords sometimes be more secure?

Does the act of requiring certain criteria for passwords make them easier to brute-force? It's always seemed to me that when websites limit the use of "insecure" passwords, it might make it easier ...
33
votes
7answers
32k views

Invalid users trying to log in to my server

I'm seeing a lot of log entries that appear to be failed login attempts from unknown IP addresses. I am using private and public keys to log in with SSH but I have noticed that even with private ...
1
vote
0answers
362 views

Storing Social Security Numbers in a Database

I'm developing an online application that needs the user's social security number. The application won't be processed on the web server so I'll be using an asymmetric key. So a compromised web server ...
2
votes
3answers
2k views

how long does it take to brute force varying encryption standards?

Let's say I want to encrypt information in a database. What would be the best encryption algorithm to use and why. I was thinking AES, since it's widely used as a government standard, but if the ...
3
votes
1answer
178 views

Is a large encrypted file more secure than a small one?

Does encrypting a large file and subsequently having to decrypt a large file make it more secure than a small one when attempting to brute force it? If you have to brute force a 25GB file and a 250MB ...
3
votes
1answer
360 views

How secure is Scrypt, really?

I've been recently taking a hard look at the scrypt system for storing users' passwords. However, I'm rather worried about it's security because of things like Litecoin miners. Is scrypt secure ...
1
vote
1answer
310 views

Brute force attack [closed]

I'm trying to make a simple script (brute force attack) on Joomla to try if it works. #! /usr/bin/python import re #regex import urllib import urllib2 x = urllib2.urlopen("http://www.demosite.center/...
25
votes
10answers
6k views

Best password strength checker

In XKCD #936: Short complex password, or long dictionary passphrase? Jeff claimed that password cracking with "dictionary words separated by spaces", or "a complete sentence with punctuation", or "...
5
votes
2answers
367 views

Detect when I do brute force attack and block the connection

My server (Ubuntu + LAMP) is infected, as I receive security alerts from the sites attacked from my IP. your Server/Customer with the IP: ********** has attacked one of our servers/partners. The ...
3
votes
2answers
275 views

How to generate a password dictionary for a specific use

I have a locked work file that I need access to. Unfortunately, the company that provided the file is no longer in existence and I can't track anyone down to help me out. The file is encrypted and ...
1
vote
3answers
131 views

Is my approach good enough for brute force protection

I don't particularly want to implement Captcha on my login form for a website. But I've got a block mechanism already in place. What's the best way to protect from Brute Force attacks? Here's what ...
5
votes
3answers
9k views

How can Facebook possibly stop a bruteforce attack on an account?

I've been doing some research on hacking recently and I found some very interesting tutorials on brute force cracking. I have some questions to ask and I'll be using Facebook as an example. Let's say ...
19
votes
4answers
4k views

Should I implement incorrect password delay in a website or a webservice?

With arguments expressed in this answer, there is a few seconds delay between user enters an incorrect password and when he/she actually learns, that password was incorrect. This security solution is ...
4
votes
3answers
243 views

Why don't sites implement a system where a wrong password causes a 3 second delay?

I am into bitcoin right now, and the password threats scare me a little... Not so much for me, because I use LastPass and generate new passwords at 20 characters and it includes symbols, upper and ...
1
vote
0answers
708 views

'http_login' metasploit module isn't able to Brute Force the target. Any suggestions? [closed]

I'm trying to Brute force the http Basic authentication on the domain pentesteracademylab.appspot.com The complete path is pentesteracademylab.appspot.com/lab/webapp/basicauth I'm using the ...