An attack using every possible input to attempt to produce the correct output. Typically the method of last resort when no weakness allows the use of a more restricted input set. E.g. trying all possible (or likely) passwords, in an attempt to guess the correct one.

learn more… | top users | synonyms

3
votes
1answer
149 views

Is a large encrypted file more secure than a small one?

Does encrypting a large file and subsequently having to decrypt a large file make it more secure than a small one when attempting to brute force it? If you have to brute force a 25GB file and a 250MB ...
3
votes
1answer
294 views

How secure is Scrypt, really?

I've been recently taking a hard look at the scrypt system for storing users' passwords. However, I'm rather worried about it's security because of things like Litecoin miners. Is scrypt secure ...
1
vote
1answer
258 views

Brute force attack [closed]

I'm trying to make a simple script (brute force attack) on Joomla to try if it works. #! /usr/bin/python import re #regex import urllib import urllib2 x = ...
25
votes
10answers
6k views

Best password strength checker

In XKCD #936: Short complex password, or long dictionary passphrase? Jeff claimed that password cracking with "dictionary words separated by spaces", or "a complete sentence with punctuation", or ...
5
votes
2answers
301 views

Detect when I do brute force attack and block the connection

My server (Ubuntu + LAMP) is infected, as I receive security alerts from the sites attacked from my IP. your Server/Customer with the IP: ********** has attacked one of our servers/partners. The ...
3
votes
2answers
225 views

How to generate a password dictionary for a specific use

I have a locked work file that I need access to. Unfortunately, the company that provided the file is no longer in existence and I can't track anyone down to help me out. The file is encrypted and ...
1
vote
3answers
125 views

Is my approach good enough for brute force protection

I don't particularly want to implement Captcha on my login form for a website. But I've got a block mechanism already in place. What's the best way to protect from Brute Force attacks? Here's what ...
5
votes
3answers
8k views

How can Facebook possibly stop a bruteforce attack on an account?

I've been doing some research on hacking recently and I found some very interesting tutorials on brute force cracking. I have some questions to ask and I'll be using Facebook as an example. Let's say ...
18
votes
4answers
4k views

Should I implement incorrect password delay in a website or a webservice?

With arguments expressed in this answer, there is a few seconds delay between user enters an incorrect password and when he/she actually learns, that password was incorrect. This security solution is ...
4
votes
3answers
218 views

Why don't sites implement a system where a wrong password causes a 3 second delay?

I am into bitcoin right now, and the password threats scare me a little... Not so much for me, because I use LastPass and generate new passwords at 20 characters and it includes symbols, upper and ...
1
vote
0answers
474 views

'http_login' metasploit module isn't able to Brute Force the target. Any suggestions? [closed]

I'm trying to Brute force the http Basic authentication on the domain pentesteracademylab.appspot.com The complete path is pentesteracademylab.appspot.com/lab/webapp/basicauth I'm using the ...
0
votes
1answer
111 views

Prevent brute force attacks on web publishing logins

Presumably, if someone tries to brute force into your website's control panel at your web host's site - they will be throttled/locked-out etc. But what about the web publishing logins (Web-Deploy, ...
3
votes
3answers
2k views

What utilities exist to brute force a username and password?

I'm trying to persuade management to purchase two factor authentication for securing VPN and terminal server access. I've made significant progress by demoing TSGrinder, but would like to list other ...
93
votes
9answers
184k views

Where can I find good dictionaries for dictionary attacks?

I’m wondering where I can find good collections of dictionaries which can be used for dictionary attacks? I've found some through Google, but I’m interested in hearing about where you get your ...
3
votes
2answers
157 views

Calculating the time required to brute force a random code

Say we have amount random entry codes of length characters from an alphabet of size alphabet. The number of possible codes is then easily calculated as keyspace = alphabet ^ length. Now take an ...
2
votes
1answer
207 views

How much does knowing the zxcvbn password strength help an attacker?

On an answer to the question How critical is it to keep your password length secret?, Mike Ounsworth commented that by storing the zxcvbn-calculated entropy of a password you make it easier for an ...
1
vote
2answers
285 views

Public/private key auth and VPN

If a server uses public/private key authentication to access SSH, will there be any advantage of restricting the access of SSH over VPN? This link describes both approaches to solve brute force ...
0
votes
2answers
319 views

Brute force time estimation - random sequence

I would like to ask if there are 2^1000 possibilities to choose from, how long would it take go through them all on average? (in terms of min, hours or years) Note: This is not necessary related to ...
1
vote
1answer
457 views

Can Hydra and Crunch be used in combination for HTTP-get-form? [closed]

I'm trying to recover my router username and password without resetting the router for educational purposes. I read that Hydra can be used for "brute-forcing" http-get-form authentication that most ...
10
votes
4answers
407 views

What are the drawbacks of login request throttling?

In a web application, one way to protect against password guessing attacks is to lock out accounts after a set number of failed logins. This could be done on both source IP address and username. For ...
1
vote
3answers
91 views

How can hackers access WordPress usernames? [duplicate]

Recently I've had brute force attack attempts on some of my WordPress sites and the attackers are using actual usernames other than the default admin (which was removed). How is it possible for them ...
20
votes
4answers
8k views

How is Gmail susceptible to brute-force attacks?

In the Atlantic article "Hacked!" it says: My wife’s password was judged as “strong” when she first chose it for use with Gmail. But it was a combination of two short English words followed by ...
3
votes
1answer
150 views

Analyzing log files for forensics homework?

Suppose two users have done a murder at 6pm at Dunkin Donuts, I have got the hard disks on site, disk1 and disk2. How do I identify the time and order of each user's activities on the hard disks? ...
4
votes
4answers
1k views

Safety of Password Hashing Using bcrypt Done on Client Side

I am currently using a technique where I send the username/password in cleartext (using https) to the server, which then does bcrypt and compares to the db. Standard practice. It is considered safe. ...
6
votes
2answers
285 views

Do I REALLY need to change my LastPass password?

Last weekend LastPass' network was compromised and that a list of email addresses along with the hashes of the master passwords were stolen. It is being recommended that LastPass users change their ...
0
votes
0answers
111 views

Would it take long to brute force a md5 hash like this?

1be8917510-36.51929856278002 10bce1af27-99.18403192423284 103fa11cc6-87.21158325206488 Few examples above and as you can see the pattern is: 1xxxxxxxxx-{a percentage (0-100) to 14 decimal places} ...
7
votes
3answers
1k views

Why do we have such big keys?

In Chapter 7 of Applied Cryptography, Bruce Schneier claims that, due to thermodynamic limitations, "brute-force attacks against 256-bit [symmetric] keys will be infeasible until computers are built ...
8
votes
4answers
7k views

How can hackers guess passwords (using dictionary attack or brute force) without being locked out?

Nowadays almost every website you want to register in; is asking you to create a complicated password...But why cant we use simple passwords? I am just wondering because in case of multiple wrong ...
9
votes
3answers
2k views

Wordpress Brute Force Attacker knows real admin Username -

I've noticed a brute force attempt on several different Wordpress installs that know the right admin user name for those respective sites... It seems very strange that the hacker would be able to ...
6
votes
3answers
1k views

Is Twitter digits login (sms auth code) insecure?

Twitter released(some time ago) a new kit named Digits which allows the client to login with a phone number and an authorization code (received through sms). I find it great for the user experience ...
18
votes
5answers
670 views

What concrete parameters can I change to make my passphrase-protected private gpg key more secure

There are several questions which discuss the resistance of passphrase-protected private gpg keys against brute force attacks. It seems, this kind of discussion could go on forever. Rather than ...
7
votes
5answers
3k views

How unlikely is it that a Google Doc link is guessed?

Most (if not all) of us know that a Google Doc link looks something like this: https://docs.google.com/document/d/13P3p5bA3lslqEJT1BGeTL1L5ZrQq_fSov_56jT9vf0I/edit There are becoming several tools ...
3
votes
3answers
316 views

How is truncation according to PCI DSS secure?

In section 3.3 of the PCI standard, it says that when displaying PANs, limiting visibility to the first 6 and last 4 digits of the PAN is considered secure. Doing some quick math, on a 16 digit PAN, ...
1
vote
1answer
783 views

how to get cookies from aspx site to use it with hydra

I've been playing around with Hydra and .aspx site and I've hit a bit of a snag - Hydra responds letting me know that the first 16 passwords in my password list are correct when none of them are. ...
0
votes
1answer
2k views

Hydra gives wrong answers

Problem: Hydra keeps giving me incorrect passwords every time. I'm using brute-force via Hydra to guess the correct password on a certain website. First of all I used BurpSuite to intercept the page ...
1
vote
1answer
134 views

Brute force a password with a lot of hash (of the same password)

I have a list of approximatively 1000 entities, defined using the following code : list[i] = md5_salt_unix_hash(random_salt, password) Where the random_salt is generated in each iteration and the ...
5
votes
1answer
2k views

Are these access.log entries successful wordpress login attempts?

I am hosting some wordpress sites on an apache 2.4 webserver, and I have discovered thousands of entries in my server logs like this: 221.219.219.248 - - [09/Mar/2015:03:29:25 +1300] "GET ...
14
votes
3answers
20k views

Why does Hydra return 16 valid passwords when none are valid?

I've been playing around with Hydra and DVWA and I've hit a bit of a snag - Hydra responds letting me know that the first 16 passwords in my password list are correct when none of them are. I assume ...
2
votes
0answers
252 views

Why does Hydra not stop when it finds a password? [closed]

Why does Hydra 8.1 not stop when it finds a password? I am using the -P option with a file that has over 5 Million passwords in it and the correct SSH password is located at approx. line 2100, but ...
0
votes
1answer
2k views

Testing Basic Authentication with ncrack

I'm conducting some basic pen testing against a page protected with Basic Authentication. I've sucessfully tested with Medusa and Hydra but am struggling to get the syntax correct for ncrack. The ...
-2
votes
4answers
436 views

Getting password cracking time and byte storage from bruteforce?

I am stuck with this question, you can see it in the picture I have included below. PARTS (a and b) I know a-z will be 26^8, A-Z will be 26^8 guesses, and 0-9 will be 10^8 guesses. But I can't relate ...
0
votes
2answers
82 views

Library or service for rate limiting credit card transactions by IP [closed]

I have a simple product ordering form. A hacker is attempting to validate stolen credit card numbers by making two orders per minute with a bot. 99% of the orders are declined but some are ...
10
votes
4answers
7k views

In light of the FREAK TLS vulnerability, why do so many servers still offer RSA-EXPORT keys?

Ars Technica is reporting on a new attack against HTTPS. Called FREAK, the devices reported as vulnerable include iPhones, Android devices, and Macs running OS X. The attack (as has been clarified ...
2
votes
2answers
408 views

Temporarily save failed logins password hashes for using against brute force attack

My question is about online brute force attacks, that try to authenticate in the website. 1) For the first case if the requests are coming from the same ip, I think this are relatively easy as after ...
6
votes
2answers
20k views

Is it possible to crack a PIN / PUK code on a phone SIM card?

When deploying a mobile phone best practices policy, one of the points which were raised was the requirement for the user to protect his SIM card with a PIN. The theory is that three failed attempts ...
3
votes
2answers
3k views

Closely spaced failed logins in auth.log

I have a raspberry-pi (running GNU/Linux) and I recently allowed my router to forward port 22 (ssh) to the raspberry-pi so that I could log in while away from home. I then noticed a bunch of ...
5
votes
1answer
9k views

Is brute-forcing the only way to crack WPA?

I don't know much about how WPA algorithms work internally. Is brute-forcing an AP the only way to crack WPA? (or to get associated with AP) Another question is about Reaver-WPS, what if an access ...
2
votes
1answer
272 views

P12 private key vs private key file : what is more secure?

The question is a bit tricky because they don't have the same purpose but : Do both kind of file face the same security issue concerning private key protection : password strenght ? (PBKDF2 as both ...
4
votes
4answers
25k views

Brute-force an SSH-login that has only a 4-letter password

Suppose, you know that a certain computer is only protected by such a short password, then you could just try every possible combination easily. How would a script look like, that tries to crack that ...
7
votes
2answers
198 views

Realistically, how much added security does having a passphrase on a ssh key have?

Let's assume ssh key brute force is unrealistic. It seems to me your greatest vulnerability would be someone gaining access to a client filesystem. If that's the case then key loggers and a host of ...