An attack using every possible input to attempt to produce the correct output. Typically the method of last resort when no weakness allows the use of a more restricted input set. E.g. trying all possible (or likely) passwords, in an attempt to guess the correct one.

learn more… | top users | synonyms

4
votes
1answer
134 views

Could a password hash that's prone to more collisions provide better overall security?

Website security breaches seem to be a common occurrence, giving the attacker password hashes that he can conduct a brute force attack against, often given him a list of passwords that will work on ...
-3
votes
3answers
10k views

How long will it take to crack a 10-15 character winrar password? [closed]

Ok, long story short, I'm currious how long it would take an agency to crack a 10-15 character winrar password. The file names in the archive are also scrambled including a word at the start and ...
4
votes
2answers
862 views

Web & insecure HTTP - Using RSA for encrypting passwords on the client side

I used client side password hashing in my register and login project. Its purpose is to prevent passive adversaries/eavesdroppers from discovering users' plaintext passwords when HTTP requests are in ...
2
votes
1answer
548 views

How large RSA-keys could the worlds combined computer power factorize in reasonable time?

If you combined every microprocessor on earth into one humongous computational cluster, how large RSA-keys could you factor in reasonable time (lets say a few years)? I know from reading the answers ...
12
votes
3answers
5k views

Cracking MS-CACHE v2 hashes using GPU

As most people here will know, Windows caches domain/AD credentials in a format known as MS-Cache v2. Obviously, these would be excellent passwords to gain during a penetration test when local access ...
1
vote
1answer
128 views

Botnet Attempting to Login to Website

Our server has recently become a target of what appears to be a botnet attack. The first indication was an insane amount of traffic to one of our client's websites - so heavy that the server entirely ...
1
vote
1answer
320 views

Use brute force to mitigate brute force

Just an idea I had, and I am sure there is a lot of material about this subject, so I am looking for a pointer as to where I can find more information. My idea is this... When storing a password in ...
2
votes
1answer
3k views

How long it will take to crack a RAR password?

I wonder how long it will take to crack 16 character alphanumeric WinRAR password for a mini supercomputer. As far as I know graphic cards are preferred over CPUs to crack passwords nowadays. If we ...
4
votes
2answers
477 views

How can i calculate the number of possible passwords?

I have found a flaw in a site where the password reset feature resets passwords in the following format UpperCaseLetter-Number-LowerCaseLetter-Number-LowerCaseLetter-Number-UpperCaseLetter ...
12
votes
2answers
525 views

Zip file with two password

I used this command to password protect a zip file on Linux : zip -P 9000 hash.zip hash.py and it creates the zip file just fine, then I wrote a program to test every possible password on it from 1 ...
1
vote
1answer
443 views

Pointers for john the ripper rulesets

I've been pouring over the JtR ruleset documentation and making little progress. I understand how to use it to make various permutations from a given wordlist, that's fine. However, I'm trying to ...
1
vote
2answers
723 views

Password Protected Zip: if attacker had one file, can use it to decrypt all files?

Consider a folder containing the following files: (file1.txt, file2.doc, file3.pdf) all zipped and password protected, if attacker had one of these file, can use it for decrypting all without knowing ...
4
votes
1answer
563 views

Securing a simple webservice against brute-force with mod-security

I want to provide basic defense against brute-force attacks against a simple HTTPS web service. The web service provides a login method (let's say at http://example.org/login) which gets passed a ...
1
vote
2answers
417 views

Brute force a GUI login?

I know I have read somewhere that the reason the UAC prompt in Windows 7 was employed is that viruses that would supposedly execute privileged instructions won't be able to "click" the confirm button ...
9
votes
4answers
496 views

Are there state-of-the-art techniques or theory specifically for attacking passphrases over passwords?

With passphrases becoming more and more common based on length being more important than complexity, I'm assuming there must be some work going on involving techniques aimed specifically at cracking / ...
1
vote
4answers
693 views

Our logs showing a lot of SSH brute force attacks originating on Port 11

this forum has been brilliant so far. Just wondering if I can get a bit more help: Can I get some info on a large amount of SSH brute force attacks originating from port 11 on the external host over ...
4
votes
4answers
547 views

Insecure to require numbers in passwords?

Earlier, I went to a site that required a number and special character, and it got me thinking – wouldn't that make the password easier to brute force? If you assume most passwords have around 12 ...
4
votes
4answers
2k views

Finding all links under a website

How can i find all directories and links under a website? Note that there is no link from home page to all other pages. For example if i have a domain like this users.company.com and each user will ...
2
votes
2answers
203 views

Slow down symetric encryption

I'm developing a program in Java. In one step data should be encrypted and exported in a file. As of now we are encrypting in AES-256 I want to slow down a possible brute force attack as much as ...
5
votes
2answers
386 views

Connection on port 3387 Event viewer says “authorized”

This event shows up multiple times within a minute like it was being brute-forced, but it says "authorized". My question is: Is there anyway I can see any commands that came in from this connection? I ...
3
votes
2answers
246 views

is it easier to get the original password if you have multiple hashes of it?

Most users tipically use the same password for multiple applications. Let's say all of these applications hash the password in some way. Would it be easier for an attacker to get the original password ...
3
votes
0answers
281 views

Can an attacker guess my password length from a hash? [duplicate]

Possible Duplicate: Possible to detect password length from hash? Is doubling your password adds more security? Considering I do not provide him any personal information relating to it, are ...
4
votes
4answers
936 views

How unlikely is it that a Google Doc link is guessed?

Most (if not all) of us know that a Google Doc link looks something like this: https://docs.google.com/document/d/13P3p5bA3lslqEJT1BGeTL1L5ZrQq_fSov_56jT9vf0I/edit There are becoming several tools ...
13
votes
4answers
934 views

Attract Brute Force SSH Attacks

I posted a question on Server Fault, but got downvoted and had the question closed. One of the comments suggested looking over here, so here goes: For my senior project, I'm working on an ...
6
votes
1answer
853 views

Brute force login attempt from spoofed IP's

I see that many of my WordPress installs are being hit with 1000+ failed login attempts using non-existing 'admin' account name. The requests come from different IP's every time, and I see IP's such ...
14
votes
3answers
2k views

Bruteforce attack on my FTP server

I recently setup VSFTPD on my personal server for sharing files over FTP. In the vsftpd.log file, i see hundreds of failed attempts to login with usernames like "adminitrator" , "adminitrator1", ...
-2
votes
2answers
4k views

What are the methods to crack WPA and WPA2? [closed]

Is there any method other than brute force and dictionary attacks to break WPA and WPA2?
3
votes
2answers
16k views

How to setup GPU for Cracking WPA/WPA2?

I have a Dell N5110 15R Laptop that I'm planning to use for GPU based cracking of WPA/WPA2 passwords. The thing is, I'm not a really big fan of password dictionaries and rainbow tables, I'd rather ...
4
votes
4answers
2k views

Are there lists of most common words or ngrams used in passwords and passphrases?

I've been thinking about ways to focus brute forcing dictionary attacks on passwords and passphrases based on the assumption that certain words, combinations of letters, and combinations of words are ...
1
vote
2answers
492 views

Securing anonymous accessible URL with a GUID segment?

In my problem there is an existing system that works as a alerting or clipping service that runs user defined searches and generates results lists. These are setup by authenticated users and this ...
15
votes
8answers
908 views

Bruteforce vs Denial of Service

I had a problem presented today which I found quite interesting. You have an application with a management panel. You know some of the accounts as they are standard. You want two things: You want ...
3
votes
1answer
749 views

Is using Gmail's browser-based client, more secure than using IMAP?

I never use the same password twice and my passwords are always comprised of a long, random string of letters, numbers and symbols. (with an offline password manager to store each password string) ...
4
votes
1answer
5k views

What is the fail2ban default setting for SSH login attempts?

I tried to block myself from my own server to test if fail2ban works correctly, so I tried ssh login and used a wrong password over and over. But I was blocked only after 13 failed logins instead of ...
2
votes
3answers
1k views

what is the fastest and cheapest way to crack this kind of hash - md5(md5($password) + salt))?

I'm looking for a program that can use any GPU (ATI\NVIDIA) and can brute force a vBulletin hash - md5(md5($password) + salt)). I have the salt and hash. the password contains the symbols - ...
5
votes
5answers
1k views

Increased security with keepass

I am using keepass for securing passwords. I have a reasonable password, but if someone got hold of the file I am sure eventually they could brute force it. I was thinking of using a key file as ...
4
votes
4answers
1k views

Throttling failed login attempts: exponential timeout? by IP? using a session cookie? captcha?

I'm beginning to think this is not as simple as it looks, and many "accepted" answers here and in SO have alternative answers that criticize them. Here is what I have gathered so far Most of what I ...
-2
votes
6answers
650 views

Are passwords made up from concatenating a few foreign words better than shorter random characters?

Does it make sense to insert a foreign word into a paraphrase to mitigate against brute force? For example: "pussiMeansCatInEskimo" "caballoMeansHorse" "CatIsGatto" "SalopeMeansBitch" ...
19
votes
5answers
3k views

What's the practical limit for rainbow-table based bruteforce?

Say we have a hash of a password. The password can be considered to be made of of totally random characters and has a fixed length of N. The hash is SHA1(password+salt), where the salt is of length M. ...
6
votes
3answers
290 views

How much added security do I really get with a longer key size?

Imagine I have a cipher which supports keys of 128, 192 or 256 bits. Suppose that there are no vulnerabilities in the cipher regardless of key length. I'm going to use it to encrypt something, and ...
2
votes
2answers
483 views

Is a password easier to brute force if it contains a repeating pattern?

My question is different from this previous question: Does repeating one word to form a password result in a similar pattern in its encrypted format?. I'm specifically wondering about brute force ...
1
vote
2answers
432 views

Known password length, brute force character in place?

We all know that brute forcing is a very slow process and trying all unnecessary possibilities is dumb. By knowing the password length, we can skip trying possibilities of other password lengths and ...
2
votes
2answers
1k views

how long does it take to brute force varying encryption standards?

Let's say I want to encrypt information in a database. What would be the best encryption algorithm to use and why. I was thinking AES, since it's widely used as a government standard, but if the ...
5
votes
1answer
795 views

Can a Bitlocker To Go user pin be brute forced?

I have a external hard disk and protected a partition on it with Bitlocker To Go. I printed the recovery code but I lost it. I can't remember the user PIN either. If I could only know the first ...
3
votes
2answers
455 views

Implementing brute force attacks on hash values in Javascript

I'm working for my bachelor thesis at the end of which I aim to implement a proof-of-concept Javascript-based hash cracker. The idea is to work like this: Users can submit a hash value along with ...
2
votes
2answers
178 views

Cloud services - A window to outsourcing illegal activities?

Recently I was exposed to a number of stories where alleged illegal activities (for this case, we can take brute-force) are outsourced to the cloud, and are run by the cloud providers. The providers, ...
5
votes
1answer
9k views

Is my router vulnerable if WPS is enabled but WPS pin code is disabled?

I was reading about Reaver and wi-fi protected setups (WPS). In my Netgear router I have the option to disable the WPS pin code, but still have the WPS push button enabled. Am I secured with such ...
18
votes
7answers
813 views

Are common passwords at particular risk?

The question Should we disallow common passwords like “password” and “12345”? on User Experience immediately made me think that these common passwords were extremely dangerous not because they are ...
1
vote
2answers
2k views

Computing RSA 1024-bit Decryption Performance [closed]

I want to be able to tell how many keys per second, using RSA 1024-bit keys, can be checked on a standard Pentium 4 system. How can I use this to determine decryption performance, and possibly ...
3
votes
3answers
457 views

How can I determine whether a website somehow protects against brute force attacks on my password? (assume I can't create an anonymous account)

After the hack of Mat Honan I studied my own laundry list of accounts I have at the numerous web sites I use. There is one fact that stands out: Many of the websites severely restrict the size and ...
14
votes
2answers
914 views

Are there some good papers (or discussions) on using Markov chains or Hidden Markov Models for password auditing/cracking?

As a programmer and language enthusiast I've been very interested in Markov chains for some time. Considering the influence of natural language on password and passphrase selection (by humans of ...