An attack using every possible input to attempt to produce the correct output. Typically the method of last resort when no weakness allows the use of a more restricted input set. E.g. trying all possible (or likely) passwords, in an attempt to guess the correct one.

learn more… | top users | synonyms

1
vote
3answers
1k views

What utilities exist to brute force a username and password?

I'm trying to persuade management to purchase two factor authentication for securing VPN and terminal server access. I've made significant progress by demoing TSGrinder, but would like to list other ...
1
vote
2answers
463 views

Brute force alphanumeric password using JohnTheRipper

I recently recovered a zip archive with some files I need access to, but I can't remember the password. All I can remember is that the password was short (around 3-4 characters), and contained only ...
1
vote
2answers
207 views

In what situations can a hacker try to break passwords millions of times? [duplicate]

I keep reading about situations where a hacker could "easily" brute force a password (most recent example) but I'm confused about when some has an opportunity to do this kind of thing. If it is a ...
1
vote
1answer
621 views

How bruteforce works code wise

I was wondering how bruteforce methods work from a code level. How does the code get access to a login page for example and insert information into the necessary fields? And is the code able to ...
1
vote
4answers
790 views

Our logs showing a lot of SSH brute force attacks originating on Port 11

this forum has been brilliant so far. Just wondering if I can get a bit more help: Can I get some info on a large amount of SSH brute force attacks originating from port 11 on the external host over ...
1
vote
3answers
330 views

Brute Force In Order Or Random?

Which is faster, on average to find the original plain text of a hash: brute force in-order, or with random plaintexts?
1
vote
2answers
827 views

Password Protected Zip: if attacker had one file, can use it to decrypt all files?

Consider a folder containing the following files: (file1.txt, file2.doc, file3.pdf) all zipped and password protected, if attacker had one of these file, can use it for decrypting all without knowing ...
1
vote
2answers
486 views

Brute force a GUI login?

I know I have read somewhere that the reason the UAC prompt in Windows 7 was employed is that viruses that would supposedly execute privileged instructions won't be able to "click" the confirm button ...
1
vote
1answer
184 views

Stripping / appending characters from user password before hashing to conceal it forever?

I had this idea to permanently conceal user password by requiring minimum length then stripping certain characters. For example if the user password is secret123, the system will strip it down to ...
1
vote
3answers
151 views

Touch tone phone username and password

I just got off the phone with Fidelity, who manage the health benefits for the company where I work. Before talking to a person, I was prompted to enter my username and password on the numeric keypad: ...
1
vote
2answers
197 views

How do you know if blowfish key is correct?

Encryption novice here so maybe this question makes no sense... Obviously if you know what the clear text is and it decrypts right, you have it. But if someone is running through keys to break the ...
1
vote
1answer
136 views

Botnet Attempting to Login to Website

Our server has recently become a target of what appears to be a botnet attack. The first indication was an insane amount of traffic to one of our client's websites - so heavy that the server entirely ...
1
vote
1answer
1k views

How many possibilities can today's computers check (per second) in a SHA512 hash of a 50-byte-long random entry? [closed]

The problem I want to avoid is "brute force" attacks against a database. So if I add a 50-byte-long cryptographically random salt to my information (which I don't need to retrieve, just its hash) - is ...
1
vote
4answers
142 views

Is there any defense against Brute-Force done on a local encrypted file?

Let me start off by saying I don't know very much about encryption, hashing, cracking, etc. I'm just a typical computer enthusiasts, programmer and researcher with many questions. So, I've discovered ...
1
vote
1answer
134 views

Why do so many cracking attempts originate from China?

I recently put a Linux server online and it didn't take long until I had the first attempts to brute-force the SSH login. It's not that I am worried about that - I trust the security of my server. But ...
1
vote
2answers
1k views

How long would it take to bruteforce an AES-128 protected pdf knowing the key is 20 letter long and that the charset is A-Z,0-9?

The question says everything, knowing that a pdf is protected using standard Adobe password encryption that comes with Acrobat Pro (which as far as i know is AES 128) how much would it take to ...
1
vote
2answers
2k views

Computing RSA 1024-bit Decryption Performance [closed]

I want to be able to tell how many keys per second, using RSA 1024-bit keys, can be checked on a standard Pentium 4 system. How can I use this to determine decryption performance, and possibly ...
1
vote
2answers
457 views

Hash, encryption of file… key? Need help [closed]

So my previous question was with some help on pcap files as I am doing a security course and we have a challenge to figure out what was going on in our network. Now one of the files I retrieved is an ...
1
vote
3answers
282 views

Mass account lockout prevention using CSRF tokens

I'm currently working on reducing the risk of mass account lockout on a site that (unfortunately) issues sequential, numeric user IDs. Changing the structure of the userID is not an option at this ...
1
vote
2answers
129 views

Why is the brute force search time for hashing algorithms 2^(num_bits / 2)?

I noticed that the brute force times (the time it takes to find a message that hashes to a given hash) of various hashing algorithms seems to be 2^(num_bits / 2). For example, people say that brute ...
1
vote
1answer
523 views

Bruteforce using crunch and Aircrack (custom starting number?)

I'm trying to do a Bruteforce attack on a handshake taken from my wireless network that is not WPS enabled. The reason I'm doing it is because I'm testing how strong a 10 digit phone number is as a ...
1
vote
1answer
636 views

Cracking MD5 passwords with the same salt

How long would it take to crack passwords up to 10 letters long if you knew the hashes were MD5 with a salt (that you know)?
1
vote
2answers
79 views

Are repeating random patterns weaker than non repeating random patterns?

Which would be harder to crack: a password comprising of n characters randomly selected or a password comprising of x randomly selected characters repeated m times so that m*x=n. For example: ...
1
vote
2answers
200 views

How to make an efficient bruteforce attack on Windows? [closed]

I've been trying to figure out a way to efficiently bruteforce on Windows, but the method I currently have isn't very efficient. I did some profiling and found out that on average it can go through ...
1
vote
1answer
5k views

Forgot password to 7-Zip archive

I think I already know the answer to this question, but I thought I'd ask the experts anyway. A few months back, I created a password-protected 7-Zip archive which housed the source code of a simple ...
1
vote
1answer
168 views

What is the strength of the key derivation function on Android device encryption?

What is is strength of the key derivation? Specifically, how many milliseconds or microseconds would it take a desktop computer to check a guessed password to see if it is a match? I am aware this ...
1
vote
1answer
553 views

Pointers for john the ripper rulesets

I've been pouring over the JtR ruleset documentation and making little progress. I understand how to use it to make various permutations from a given wordlist, that's fine. However, I'm trying to ...
1
vote
2answers
702 views

Can you crack a Mailinator “Alternate Inbox Name?”

From their FAQ: What are "Alternate Inbox Names" ? There are 2 ways to get email into any given inbox. When you check an inbox, listed at the top is the Alternate Inbox name. Emailing that alternate ...
1
vote
2answers
582 views

Securing anonymous accessible URL with a GUID segment?

In my problem there is an existing system that works as a alerting or clipping service that runs user defined searches and generates results lists. These are setup by authenticated users and this ...
1
vote
1answer
288 views

How do we estimate the time taken to crack a hash using brute force techniques

A German hacker famously managed to brute force crack a 160 bit SHA1 hash with passwords between 1 to 6 digits in 49 minutes. Now keeping everything constant (hardware, cracking technique - here ...
1
vote
1answer
139 views

Can Hydra crack a flash-based login?

Is it possible to brute force a flash login with hydra? If not, what is a good tool to pen test a flash login?
1
vote
1answer
124 views

Username Enumeration as a Threat

I have found a Username Enumeration Vulnerability through which I am able to determine whether a particular user is registered with that site. While trying to brute force, after 5 attempts it asks for ...
1
vote
1answer
503 views

Hydra gives wrong passwords

I've been trying to use hydra (educational way) but with no success. The site method is http-post but performed by ajax (should it be a problem? I think not). After execute the command I got an output ...
1
vote
1answer
5k views

How to use http-get-form in THC-Hydra?

I've been messing with Hydra (Brute Force) to solve the "Damn Vulnerable Web App" brute force section but the problem is when I use http-get-form it said: Warning: child 1 seems to have died, ...
1
vote
0answers
604 views

Brute-Force/Dictionary attack against encypted file using PBKDF2 key derivation

I have been following this very useful post by Thomas. My use case is slightly different. I am developing a mobile application which requires some sensitive data to be stored on the device in a SQLite ...
1
vote
0answers
2k views

BruteForce on Hydra (Usernames or Password with Special-Chars), letter “Ñ”

I use Hydra with the Web-Form (Http-Post-Form); and I'm trying to use a list of Usernames when some of the nicks contain a letter ñ. For example I have the following account in my list: Username: ...
1
vote
0answers
3k views

Linux Hydra issue - random correct password success

I have an issue with Hydra when I use it. I have tried the same command lines given in guides directly supported by the Damn Vulnerable Web Application (DVWA) v1.8. Ok so.. here is my attempt ...
1
vote
1answer
677 views

Brute Forcing Domain Controller

I have a MS-Server2K3 domain controller that also serves as a Exchange server. Due to recent network speed loss and issues I began looking at event logs and noticed an exceptionally large number of ...
1
vote
1answer
626 views

Distributed IMAP-Dictionary-Attack-Tool?

I have a client with a hacked IMAP-Account, and the attacker(s) made thousands of password-attempts, probably with a fixed set of passwords, from different IPs before they got in. After successful ...
0
votes
3answers
157 views

Safety of Password Hashing Using bcrypt Done on Client Side

I am currently using a technique where I send the username/password in cleartext (using https) to the server, which then does bcrypt and compares to the db. Standard practice. It is considered safe. ...
0
votes
1answer
6k views

Has the WPS brute-force cracking issue been fixed?

I have heard a rumor that the WPS brute force attack doesn't work on newer devices, and that you now have to try all 10^7 PINs to find the correct one. Is that true?
0
votes
3answers
2k views

Number of AES-256 operations per second on a maximized Cray XE6

How many FLOPs does one AES-256 operation take in ECB mode? How many AES-256 operations in ECB mode can a maximized Cray XE6 perform per second? Cray states that it can be scaled to over 1 million ...
0
votes
3answers
1k views

What are the differences between dictionary attack and brute force attack?

Can someone explain the major differences between a Brute force attack and a Dictionary attack. Does the term rainbow table has any relation with these?
0
votes
1answer
91 views

Reporting an IP address

This morning while checking /var/log/secure to troubleshoot an issue with my Centos VPS, I found that there has been too many SSH bruteforce attempts from 54.93.174.60 for the past couple of days. I ...
0
votes
2answers
72 views

Why don't sites implement a system where a wrong password causes a 3 second delay?

I am into bitcoin right now, and the password threats scare me a little... Not so much for me, because I use LastPass and generate new passwords at 20 characters and it includes symbols, upper and ...
0
votes
2answers
398 views

Bruteforce Passphrase of Dictionary Words

Consider the all lowercase passphrase: "lazy fox haggles treaty" Assume all four words are in a dictionary of 2000. Bruteforcing word combinations, how long does it take to crack this password at ...
0
votes
1answer
150 views

How can brute force scripts tell once they're found the correct key?

If you have a random block of data and you encrypt it with a key, how can a brute force script tell when it has found the correct key? Is it possible without some sort of reference to the original ...
0
votes
1answer
63 views

Can a botnet be used to effectively break encryption keys?

Can a botnet amass and coordinate enough computing power to break encryption keys that are typically considered to be secure (through brute force)? If this is the case, do we need to make our ...
0
votes
1answer
2k views

Cracking a web form based logon with hydra [closed]

How do I have to use hydra on a web form? What I have done so far: I already successfully used hydra on a folder with an HTTP authentication: http://localhost/test/authtest/ with user admin and ...
0
votes
2answers
96 views

How do you overcome the problem of the salt being public and known by the attacker? [duplicate]

I believe that when adding a salt to the password you need to store the values so you can compute the hash again. But, what does happen if the attacker get the salt? How is it possible to add value ...