An attack using every possible input to attempt to produce the correct output. Typically the method of last resort when no weakness allows the use of a more restricted input set. E.g. trying all possible (or likely) passwords, in an attempt to guess the correct one.

learn more… | top users | synonyms

3
votes
1answer
371 views

Non English password dictionaries

What is a good resource for wordlists used in auditing passwords in non english languages. I have extensive wordlists in English ranging to several GB's, but can't find similar resources for other ...
6
votes
2answers
514 views

How can I restrict users' connection attempts to my FTP server?

Is there any way possible to restrict user to make a connection to the FTP server on my Windows XP computer? I have an FTP server established in Windows XP and now I want to make access to that FTP ...
5
votes
1answer
153 views

General purpose slow/unique hash routine for dup checking of private data, without storing the data itself?

I am wondering if there is a percentage of uniqueness known to be lost with every repeat of various hash routines, like MD5, SHA1, and how that might compare with other algorithms. If theoretically I ...
6
votes
5answers
812 views

Are there any security measures that are resistant to a brute force attack?

I'm not talking in particular about encryption, but security as a whole. Are there any security measures that can be put in place to protect data and/or a system that can withstand even a hypothetical ...
6
votes
3answers
271 views

How do I secure my advertisement space against ad overlay browser attachments?

I don't really have an issue with advertisements simply being blocked by individual users who are visiting a customers site or my own site. As an individual you have the freedom to choose not to look ...
1
vote
3answers
1k views

What utilities exist to brute force a username and password?

I'm trying to persuade management to purchase two factor authentication for securing VPN and terminal server access. I've made significant progress by demoing TSGrinder, but would like to list other ...
6
votes
4answers
3k views

Is .htaccess protection secure enough?

For the moment we protect a directory on our site with .htaccess and .htpasswd. But I was wondering how secure this is? Are there things I should watch for or can do make it more secure? I don't know ...
13
votes
1answer
1k views

Timing attacks on password hashes

Timing attacks can have a devastating impact in scenarios where the secret is involved, often in cases where byte-wise array comparison is used. Now there are those that advertise using constant ...
-1
votes
3answers
2k views

Number of AES-256 operations per second on a maximized Cray XE6

How many FLOPs does one AES-256 operation take in ECB mode? How many AES-256 operations in ECB mode can a maximized Cray XE6 perform per second? Cray states that it can be scaled to over 1 million ...
6
votes
4answers
1k views

Password entropy in layman's terms

Entropy is a term used often in relation to password security and brute-force attacks, but it is a topic that can get complicated quickly. What is the best way to describe password entropy (what it is ...
3
votes
1answer
709 views

It's really that insecure to have POP3 enabled in my gmail account?

Several people are claiming that you should turn off pop3 in gmail because it allowed bruteforce attacks on the password. Doesn't Google prevent this kind of attacks? What is the truth on this ...
4
votes
2answers
727 views

Known Password Lengths and security considerations

Many people wil often brag about the length of their password, like "yeah nobody is ever going to crack my password cause its 22 characters long." I was thinking, if you knew the exact length of their ...
10
votes
2answers
321 views

How much security is compromised if we accept other characters as login (other than the original password)?

I've just realised that facebook accepts 3 forms of a password: Source: Facebook actually accepts three forms of your password: Your original password. Your original password with the ...
6
votes
2answers
2k views

Dictionary Attack on Wifi

I know a few people with pretty weak passwords. What kind of systems exist to prevent dictionary attacks? Would it make sense to restrict the number of connection attempts in a certain timeframe? ...
7
votes
3answers
558 views

It is possible that brute force attempts are successful before the worst case, correct?

When I read about a password being secure and stating that it would take X amount of week, years, etc. isn't that referring to the worst case? What happens if the brute force method is successul in ...
8
votes
3answers
1k views

time to crack file-encryption password - more than just iteration

I have often seen that takes x amount of time to crack a certain length password. But this just seems to be the amount of time it takes to iterate through all the possibilities. What about the time it ...
3
votes
1answer
19k views

How long to brute-force WPA password?

Bob has a password (for his WPA encrypted wifi) which is 8 characters, all lowercase, and not a dictionary word. Eve lives next door to Bob and wants to illegally hack his WPA. The number of ...
4
votes
3answers
170 views

What alternatives do email services provide when an account is hacked?

I am concerned about how does email services like Yahoo, Gmail, Hotmail etc provide security to their costumers and prevent their account from being compromised. For example, I have seen that if ...
4
votes
4answers
954 views

Brute-force heuristics used in password cracking

Existing questions on this site discuss some of the heuristics used by password cracking tools to avoid doing a completely naive brute-force search (for example, "dictionary word with number ...
6
votes
3answers
771 views

Attack vectors for brute-forcing website passwords

When talking about password security, a lot of discussion centers on the risk of a password being guessed in a brute-force attack. For websites where a user has registered an account, what are the ...
1
vote
5answers
276 views

Is there something similar to DNSBL's for protecting against forceful browsing?

I want to protect a couple of Apache webservers against forceful browsing. Lately there have been multiple scans querying for non-existent applications on them like phpMyAdmin, notably known for their ...
5
votes
2answers
2k views

Why limit passwords to ascii printable characters? [duplicate]

Possible Duplicate: Do non-keyboard characters make my password less susceptible to brute forcing? Every article on password security that I read tells people to make the password more ...
4
votes
4answers
4k views

Brute force vs other methods of recovering passwords from shadow file

Do you know any good approach for de-hashing/actually bruteforcing hashed passwords in the shadow file? On various operating systems, any good solutions/methods/programs. Or is it better to upload ...
5
votes
4answers
167 views

software to keep a list of IP that try to access ssh over a set of rules and feasibility

i'm interested in software or set of scripts to keep a lists of filtered IP that attempt to brute-force ssh, and to label an IP as brute-forcing i would add some checks like: one attempt to log as ...
18
votes
4answers
8k views

how long does it take to actually generate rainbow tables?

I've been reading up about rainbow tables as I think they're quite interesting cause they're actually a pretty simple concept. Anyway, I was wondering, has anyone been involved in actually generating ...
4
votes
2answers
4k views

Can DES-based hashed password be recovered if salt is known?

Can a hashed password be recovered if the hashing is done with DES based crypt function in PHP and both the hash and salt are known by the attacker? Consider the following example: $salt = 'mysalt'; ...
3
votes
1answer
935 views

Will using unicode chars in my password increase security? [duplicate]

Possible Duplicate: Do non-keyboard characters make my password less susceptible to brute forcing? Bruteforce tries cracking the hash with every possible combination of letters. Then, If ...
31
votes
4answers
15k views

Are salted SHA-256/512 hashes still safe if the hashes and their salts are exposed?

Scenario: a database of hashed and and salted passwords, including salts for each password, is stolen by a malicious user. Passwords are 6-10 chars long and chosen by non-technical users. Can this ...
8
votes
1answer
154 views

Long running SMTP session

I recently noticed an SMTP session on my server which started when a remote host connected but never seemed to result in any emails being delivered. I could see that it was probably a SPAM site and so ...
2
votes
1answer
707 views

Pen test cell-phones

A customer has asked to conduct a pen-test on the phones of employees. The target is text messages in the phones. Text messages are stored on the SIM for security reasons. Physical access to the ...