An attack using every possible input to attempt to produce the correct output. Typically the method of last resort when no weakness allows the use of a more restricted input set. E.g. trying all possible (or likely) passwords, in an attempt to guess the correct one.

learn more… | top users | synonyms

4
votes
1answer
683 views

Securing a simple webservice against brute-force with mod-security

I want to provide basic defense against brute-force attacks against a simple HTTPS web service. The web service provides a login method (let's say at http://example.org/login) which gets passed a ...
1
vote
2answers
491 views

Brute force a GUI login?

I know I have read somewhere that the reason the UAC prompt in Windows 7 was employed is that viruses that would supposedly execute privileged instructions won't be able to "click" the confirm button ...
9
votes
4answers
517 views

Are there state-of-the-art techniques or theory specifically for attacking passphrases over passwords?

With passphrases becoming more and more common based on length being more important than complexity, I'm assuming there must be some work going on involving techniques aimed specifically at cracking / ...
1
vote
4answers
790 views

Our logs showing a lot of SSH brute force attacks originating on Port 11

this forum has been brilliant so far. Just wondering if I can get a bit more help: Can I get some info on a large amount of SSH brute force attacks originating from port 11 on the external host over ...
4
votes
4answers
603 views

Insecure to require numbers in passwords?

Earlier, I went to a site that required a number and special character, and it got me thinking – wouldn't that make the password easier to brute force? If you assume most passwords have around 12 ...
5
votes
4answers
3k views

Finding all links under a website

How can i find all directories and links under a website? Note that there is no link from home page to all other pages. For example if i have a domain like this users.company.com and each user will ...
2
votes
2answers
217 views

Slow down symetric encryption

I'm developing a program in Java. In one step data should be encrypted and exported in a file. As of now we are encrypting in AES-256 I want to slow down a possible brute force attack as much as ...
5
votes
2answers
429 views

Connection on port 3387 Event viewer says “authorized”

This event shows up multiple times within a minute like it was being brute-forced, but it says "authorized". My question is: Is there anyway I can see any commands that came in from this connection? I ...
3
votes
2answers
274 views

is it easier to get the original password if you have multiple hashes of it?

Most users tipically use the same password for multiple applications. Let's say all of these applications hash the password in some way. Would it be easier for an attacker to get the original password ...
3
votes
0answers
281 views

Can an attacker guess my password length from a hash? [duplicate]

Possible Duplicate: Possible to detect password length from hash? Is doubling your password adds more security? Considering I do not provide him any personal information relating to it, are ...
4
votes
4answers
1k views

How unlikely is it that a Google Doc link is guessed?

Most (if not all) of us know that a Google Doc link looks something like this: https://docs.google.com/document/d/13P3p5bA3lslqEJT1BGeTL1L5ZrQq_fSov_56jT9vf0I/edit There are becoming several tools ...
13
votes
4answers
1k views

Attract Brute Force SSH Attacks

I posted a question on Server Fault, but got downvoted and had the question closed. One of the comments suggested looking over here, so here goes: For my senior project, I'm working on an ...
7
votes
1answer
983 views

Brute force login attempt from spoofed IP's

I see that many of my WordPress installs are being hit with 1000+ failed login attempts using non-existing 'admin' account name. The requests come from different IP's every time, and I see IP's such ...
14
votes
3answers
3k views

Bruteforce attack on my FTP server

I recently setup VSFTPD on my personal server for sharing files over FTP. In the vsftpd.log file, i see hundreds of failed attempts to login with usernames like "adminitrator" , "adminitrator1", ...
-2
votes
2answers
5k views

What are the methods to crack WPA and WPA2? [closed]

Is there any method other than brute force and dictionary attacks to break WPA and WPA2?
3
votes
2answers
19k views

How to setup GPU for Cracking WPA/WPA2?

I have a Dell N5110 15R Laptop that I'm planning to use for GPU based cracking of WPA/WPA2 passwords. The thing is, I'm not a really big fan of password dictionaries and rainbow tables, I'd rather ...
4
votes
4answers
2k views

Are there lists of most common words or ngrams used in passwords and passphrases?

I've been thinking about ways to focus brute forcing dictionary attacks on passwords and passphrases based on the assumption that certain words, combinations of letters, and combinations of words are ...
1
vote
2answers
582 views

Securing anonymous accessible URL with a GUID segment?

In my problem there is an existing system that works as a alerting or clipping service that runs user defined searches and generates results lists. These are setup by authenticated users and this ...
15
votes
8answers
976 views

Bruteforce vs Denial of Service

I had a problem presented today which I found quite interesting. You have an application with a management panel. You know some of the accounts as they are standard. You want two things: You want ...
3
votes
1answer
935 views

Is using Gmail's browser-based client, more secure than using IMAP?

I never use the same password twice and my passwords are always comprised of a long, random string of letters, numbers and symbols. (with an offline password manager to store each password string) ...
5
votes
1answer
6k views

What is the fail2ban default setting for SSH login attempts?

I tried to block myself from my own server to test if fail2ban works correctly, so I tried ssh login and used a wrong password over and over. But I was blocked only after 13 failed logins instead of ...
3
votes
3answers
1k views

what is the fastest and cheapest way to crack this kind of hash - md5(md5($password) + salt))?

I'm looking for a program that can use any GPU (ATI\NVIDIA) and can brute force a vBulletin hash - md5(md5($password) + salt)). I have the salt and hash. the password contains the symbols - ...
5
votes
5answers
1k views

Increased security with keepass

I am using keepass for securing passwords. I have a reasonable password, but if someone got hold of the file I am sure eventually they could brute force it. I was thinking of using a key file as ...
4
votes
4answers
2k views

Throttling failed login attempts: exponential timeout? by IP? using a session cookie? captcha?

I'm beginning to think this is not as simple as it looks, and many "accepted" answers here and in SO have alternative answers that criticize them. Here is what I have gathered so far Most of what I ...
20
votes
5answers
4k views

What's the practical limit for rainbow-table based bruteforce?

Say we have a hash of a password. The password can be considered to be made of of totally random characters and has a fixed length of N. The hash is SHA1(password+salt), where the salt is of length M. ...
6
votes
3answers
301 views

How much added security do I really get with a longer key size?

Imagine I have a cipher which supports keys of 128, 192 or 256 bits. Suppose that there are no vulnerabilities in the cipher regardless of key length. I'm going to use it to encrypt something, and ...
2
votes
2answers
560 views

Is a password easier to brute force if it contains a repeating pattern?

My question is different from this previous question: Does repeating one word to form a password result in a similar pattern in its encrypted format?. I'm specifically wondering about brute force ...
1
vote
2answers
479 views

Known password length, brute force character in place?

We all know that brute forcing is a very slow process and trying all unnecessary possibilities is dumb. By knowing the password length, we can skip trying possibilities of other password lengths and ...
2
votes
2answers
2k views

how long does it take to brute force varying encryption standards?

Let's say I want to encrypt information in a database. What would be the best encryption algorithm to use and why. I was thinking AES, since it's widely used as a government standard, but if the ...
5
votes
1answer
964 views

Can a Bitlocker To Go user pin be brute forced?

I have a external hard disk and protected a partition on it with Bitlocker To Go. I printed the recovery code but I lost it. I can't remember the user PIN either. If I could only know the first ...
3
votes
2answers
514 views

Implementing brute force attacks on hash values in Javascript

I'm working for my bachelor thesis at the end of which I aim to implement a proof-of-concept Javascript-based hash cracker. The idea is to work like this: Users can submit a hash value along with ...
2
votes
2answers
193 views

Cloud services - A window to outsourcing illegal activities?

Recently I was exposed to a number of stories where alleged illegal activities (for this case, we can take brute-force) are outsourced to the cloud, and are run by the cloud providers. The providers, ...
6
votes
1answer
10k views

Is my router vulnerable if WPS is enabled but WPS pin code is disabled?

I was reading about Reaver and wi-fi protected setups (WPS). In my Netgear router I have the option to disable the WPS pin code, but still have the WPS push button enabled. Am I secured with such ...
18
votes
7answers
848 views

Are common passwords at particular risk?

The question Should we disallow common passwords like “password” and “12345”? on User Experience immediately made me think that these common passwords were extremely dangerous not because they are ...
1
vote
2answers
2k views

Computing RSA 1024-bit Decryption Performance [closed]

I want to be able to tell how many keys per second, using RSA 1024-bit keys, can be checked on a standard Pentium 4 system. How can I use this to determine decryption performance, and possibly ...
3
votes
3answers
500 views

How can I determine whether a website somehow protects against brute force attacks on my password? (assume I can't create an anonymous account)

After the hack of Mat Honan I studied my own laundry list of accounts I have at the numerous web sites I use. There is one fact that stands out: Many of the websites severely restrict the size and ...
14
votes
2answers
1k views

Are there some good papers (or discussions) on using Markov chains or Hidden Markov Models for password auditing/cracking?

As a programmer and language enthusiast I've been very interested in Markov chains for some time. Considering the influence of natural language on password and passphrase selection (by humans of ...
1
vote
2answers
349 views

Seeking advice on how to build a box to brute force hashes? [closed]

I work in a startup security firm, and I need to build a GPU-based to brute force password/hashes, which can be used to validate password strength and test hashing algorithms. I expect some high ...
1
vote
2answers
457 views

Hash, encryption of file… key? Need help [closed]

So my previous question was with some help on pcap files as I am doing a security course and we have a challenge to figure out what was going on in our network. Now one of the files I retrieved is an ...
2
votes
1answer
2k views

Brute-force a passphrase, generated by `pwgen 16 -s`, of a GPG CAST5 archive

A sad story: One of our hard drives failed. While it was failing, we managed to take a quick backup. As it is our standard practice, we encrypted the backup using GPG (by however method Duplicity uses ...
1
vote
1answer
5k views

How to use http-get-form in THC-Hydra?

I've been messing with Hydra (Brute Force) to solve the "Damn Vulnerable Web App" brute force section but the problem is when I use http-get-form it said: Warning: child 1 seems to have died, ...
4
votes
3answers
1k views

Securing AES 128 encrypted ZIPs against brute force attacks

How long would it take to brute force decrypt an AES 128 encrypted zip file if the password is 8 characters long in the range of A-Z, a-z, 1-9? Does it make any difference if .NET's System.Random ...
5
votes
5answers
2k views

What password cracking software is commonly used?

I am curious to know how secure my passwords are. What password cracking software is commonly used? Preferably open source. EDIT: I am actually looking to crack my passwords used on services I ...
2
votes
2answers
190 views

ASLR in Ubuntu 11.10

In many of the exploits I see nowadays, brute forcing is a common method of bypassing ASLR on 32 bit machines. However, many of these exploits crash the current process, for example, PHP. Isn't the ...
1
vote
3answers
282 views

Mass account lockout prevention using CSRF tokens

I'm currently working on reducing the risk of mass account lockout on a site that (unfortunately) issues sequential, numeric user IDs. Changing the structure of the userID is not an option at this ...
4
votes
1answer
670 views

Reasonable (BruteForce) Attempts/Second Estimate?

I've read various articles on password strength and passwords vs pass phrases (including the one from XKCD and its thread here), but most of those articles seem to be focused on online passwords, and ...
2
votes
3answers
4k views

How should I defend against TightVNC brute-force attacks?

How should I defend against this type of attack? This is a tightvnc logfile excerpt from a linode cloud server running Ubuntu 12.04 (Precise) with the ubuntu-desktop package added to the bare server. ...
15
votes
4answers
3k views

Protection against account lockout DoS

Any ideas on how to protect against the following scenario? Company x uses active directory for authentication of it's employees. The company has multiple authentication points that are semi-public ...
5
votes
2answers
282 views

Are more passwords breached via dictionary/bf attacks or via packet-sniffers/key-loggers?

This question has always intrigued me whenever the subject of passwords is brought up. Does anyone have direct experience or a reputable source to answer what percentage of password breaches are ...
3
votes
1answer
467 views

Academic papers on GPU password cracking?

Are there any scientific papers or publications on GPU password cracking?