An attack using every possible input to attempt to produce the correct output. Typically the method of last resort when no weakness allows the use of a more restricted input set. E.g. trying all possible (or likely) passwords, in an attempt to guess the correct one.

learn more… | top users | synonyms

4
votes
1answer
964 views

Reasonable (BruteForce) Attempts/Second Estimate?

I've read various articles on password strength and passwords vs pass phrases (including the one from XKCD and its thread here), but most of those articles seem to be focused on online passwords, and ...
4
votes
1answer
431 views

WPA2 audit tool

For the purposes of my own research, I have a very modest budget to set up a modest WPA2 brute-forcer supported by GPU(s). I've done some homework: Brute-Force GPU Password Crackers How to setup ...
3
votes
2answers
32k views

Remove Password Protection from XLS Document

Similar to what is listed here, http://datapigtechnologies.com/blog/index.php/hack-into-a-protected-excel-2007-or-2010-workbook/, is there a way to remove the password from an XLS (Excel 2003) ...
3
votes
2answers
19k views

How long would it take to bruteforce an AES-128 protected pdf knowing the key is 20 letter long and that the charset is A-Z,0-9?

The question says everything, knowing that a pdf is protected using standard Adobe password encryption that comes with Acrobat Pro (which as far as i know is AES 128) how much would it take to ...
3
votes
3answers
7k views

How should I defend against TightVNC brute-force attacks?

How should I defend against this type of attack? This is a tightvnc logfile excerpt from a linode cloud server running Ubuntu 12.04 (Precise) with the ubuntu-desktop package added to the bare server. ...
3
votes
2answers
1k views

Is a password easier to brute force if it contains a repeating pattern?

My question is different from this previous question: Does repeating one word to form a password result in a similar pattern in its encrypted format?. I'm specifically wondering about brute force ...
3
votes
3answers
2k views

What utilities exist to brute force a username and password?

I'm trying to persuade management to purchase two factor authentication for securing VPN and terminal server access. I've made significant progress by demoing TSGrinder, but would like to list other ...
3
votes
2answers
91 views

What scenario are 'extra' strong passwords and hashing algorithms actually protecting against?

Note: I completely understand the need for strong passwords & I understand that there is an issue of speed with hashing. I am just interested in better understanding the actual negative impact of ...
3
votes
1answer
161 views

Is a large encrypted file more secure than a small one?

Does encrypting a large file and subsequently having to decrypt a large file make it more secure than a small one when attempting to brute force it? If you have to brute force a 25GB file and a 250MB ...
3
votes
3answers
857 views

Calculate time taken to break AES key

A 256 bit AES key is required to be broken using the brute force method on a 2GHz computer. How long would it take to break the key in the best case and in the worst case situations? Assume that 1000 ...
3
votes
1answer
379 views

Can a Windows or Linux password be brute-forced on a public network?

I am at a hotel that has a public network. I have a Windows machine with a wired connection to it. "Network and Sharing" has network discovery on. No folders are shared except "Users", which is shared ...
3
votes
5answers
710 views

Is passwords with combination of different encodings super safe?

I was thinking about generating passwords with combination of English, Arabic, Chinese charac. Is this pass secure enough against brute force attacks?
3
votes
1answer
66 views

Two factor brute force protection

If I implement two factor authentication using TOTP, I (obviously) have to protect against simple brute force attacks of the TOTP value. If I ask for the TOTP value after successful password login, ...
3
votes
3answers
349 views

Is login limiting still needed if we employ multi-factor authentication?

The status quo is that most online websites limit login attempts per IP address, or even per account since some attackers possess huge amounts of IP addresses. OWASP declares: When multi-factor ...
3
votes
3answers
1k views

Why are MD5 collisions dangerous?

I understand that the MD5 algorithm isn't collision resistant, and that collisions between data of arbitrary size can be found with more efficient methods than brute-forcing. However, I have read ...
3
votes
2answers
680 views

Implementing brute force attacks on hash values in Javascript

I'm working for my bachelor thesis at the end of which I aim to implement a proof-of-concept Javascript-based hash cracker. The idea is to work like this: Users can submit a hash value along with ...
3
votes
1answer
572 views

Academic papers on GPU password cracking?

Are there any scientific papers or publications on GPU password cracking?
3
votes
2answers
239 views

How to generate a password dictionary for a specific use

I have a locked work file that I need access to. Unfortunately, the company that provided the file is no longer in existence and I can't track anyone down to help me out. The file is encrypted and ...
3
votes
3answers
351 views

How is truncation according to PCI DSS secure?

In section 3.3 of the PCI standard, it says that when displaying PANs, limiting visibility to the first 6 and last 4 digits of the PAN is considered secure. Doing some quick math, on a 16 digit PAN, ...
3
votes
1answer
1k views

How large RSA-keys could the worlds combined computer power factorize in reasonable time?

If you combined every microprocessor on earth into one humongous computational cluster, how large RSA-keys could you factor in reasonable time (lets say a few years)? I know from reading the answers ...
3
votes
2answers
7k views

How long it will take to crack a RAR password?

I wonder how long it will take to crack 16 character alphanumeric WinRAR password for a mini supercomputer. As far as I know graphic cards are preferred over CPUs to crack passwords nowadays. If we ...
3
votes
1answer
939 views

Pointers for john the ripper rulesets

I've been pouring over the JtR ruleset documentation and making little progress. I understand how to use it to make various permutations from a given wordlist, that's fine. However, I'm trying to ...
3
votes
1answer
2k views

Will using unicode chars in my password increase security? [duplicate]

Possible Duplicate: Do non-keyboard characters make my password less susceptible to brute forcing? Bruteforce tries cracking the hash with every possible combination of letters. Then, If ...
3
votes
3answers
113 views

Are login pages with no retry counts/lockouts a security risk?

I found a login page for a city/edu organisation that has no session times, no retry counter/lockout, and no delays if too many tries are made in a certain timeframe. I am able to exploit this to get ...
3
votes
1answer
317 views

How secure is Scrypt, really?

I've been recently taking a hard look at the scrypt system for storing users' passwords. However, I'm rather worried about it's security because of things like Litecoin miners. Is scrypt secure ...
3
votes
1answer
3k views

Hydra bruteforce and JSON

I am having problems with Hydra and a JSON payload. The login request (intercepted with Fiddler), is the following: POST http://architectureservice.test.com/api/v1/login HTTP/1.1 Host: ...
3
votes
2answers
1k views

Failed RDP brute force attack from Microsoft IP address?

I use RDPGuard on my webserver. I have noticed that it blocked an IP address which seemed to originate from a Microsoft registered IP address: Process Information: Caller Process ID: 0xf78 Caller ...
3
votes
3answers
447 views

How to optimize compressed file cracking?

I'm currently doing research on cracking encrypted, compressed files (specifically: uif, zip, 7z, dmg). Looking at all the utilities out there, it seems the time it takes to crack something is ...
3
votes
1answer
58 views

Is there value in slowing down retries on a fingerprint lock?

My phone has a fingerprint lock and it sometimes fails to identify my fingerprint (for example, if it wasn't positioned correctly). If I fail fingerprint identification 5 times in a row, I'm locked ...
3
votes
2answers
173 views

Calculating the time required to brute force a random code

Say we have amount random entry codes of length characters from an alphabet of size alphabet. The number of possible codes is then easily calculated as keyspace = alphabet ^ length. Now take an ...
3
votes
2answers
3k views

Closely spaced failed logins in auth.log

I have a raspberry-pi (running GNU/Linux) and I recently allowed my router to forward port 22 (ssh) to the raspberry-pi so that I could log in while away from home. I then noticed a bunch of ...
3
votes
1answer
608 views

Cracking a 6-character alphanumeric password Windows dialog box

To put this problem in context, I have a touch monitor screen whose firmware program is protected by a password. The firmware program is downloaded over RS232 via a Windows utility program provided ...
3
votes
1answer
498 views

Better than brute-force way to find the “lowest” sha1 hash?

While pointing out a SQL injection flaw on another question, I was able to show that an arbitrary sha1 hash could be inserted into a query such that it would be taken for a real hash, and was ...
3
votes
2answers
26k views

How to setup GPU for Cracking WPA/WPA2?

I have a Dell N5110 15R Laptop that I'm planning to use for GPU based cracking of WPA/WPA2 passwords. The thing is, I'm not a really big fan of password dictionaries and rainbow tables, I'd rather ...
3
votes
2answers
180 views

Is there known statistics of passwords used during brute force password attacks?

I have been reading quite a bit about brute force attacks and I am wondering whether the passwords that are used in such attacks should be kept around so as to later prevent my users from having those ...
3
votes
1answer
225 views

Writing your own John the Ripper module

I have a script in C, which is able to determine the password of certain data. It uses HMAC and RC4 algorithms to encrypt the given password and then compares that later to the given data. If they ...
3
votes
1answer
152 views

Analyzing log files for forensics homework?

Suppose two users have done a murder at 6pm at Dunkin Donuts, I have got the hard disks on site, disk1 and disk2. How do I identify the time and order of each user's activities on the hard disks? ...
3
votes
1answer
493 views

Non English password dictionaries

What is a good resource for wordlists used in auditing passwords in non english languages. I have extensive wordlists in English ranging to several GB's, but can't find similar resources for other ...
3
votes
0answers
36 views

Reaver stuck at flow_handler

I tried to run Reaver against my router at home using an Ubuntu 15.10 laptop. The command used was: sudo reaver -i mon0 -b XX:XX:XX:XX:XX:XX -vv -c 7 -a (the channel I got from aerodump-ng). I'm ...
3
votes
0answers
287 views

Can an attacker guess my password length from a hash? [duplicate]

Possible Duplicate: Possible to detect password length from hash? Is doubling your password adds more security? Considering I do not provide him any personal information relating to it, are ...
2
votes
3answers
2k views

what is the fastest and cheapest way to crack this kind of hash - md5(md5($password) + salt))?

I'm looking for a program that can use any GPU (ATI\NVIDIA) and can brute force a vBulletin hash - md5(md5($password) + salt)). I have the salt and hash. the password contains the symbols - ...
2
votes
3answers
924 views

Is there an internal equivalent to fail2ban?

fail2ban is a protection against brute-force that locks a user out after a definable maximum failed login-attempts. But if a user already has access to a server with another username already fail2ban ...
2
votes
1answer
3k views

What are realistic rates for brute force hashing?

I'm trying to gauge password strength assuming that the attacker has a hash of my password. Can anyone cite some realistic contemporary rates at which someone could perform various hashes? I know most ...
2
votes
1answer
866 views

Reporting an IP address

This morning while checking /var/log/secure to troubleshoot an issue with my Centos VPS, I found that there has been too many SSH bruteforce attempts from 54.93.174.60 for the past couple of days. I ...
2
votes
2answers
271 views

Slow down symetric encryption

I'm developing a program in Java. In one step data should be encrypted and exported in a file. As of now we are encrypting in AES-256 I want to slow down a possible brute force attack as much as ...
2
votes
2answers
192 views

Why do websites force the user to use a long and complicated password when brute force isn't possible?

if you have a phone with 4-digit pin and the phone does not get locked no matter how many times you put the wrong pin it makes sense to use 10 or 16 digits as it'll increase the time the attacker ...
2
votes
1answer
214 views

How much does knowing the zxcvbn password strength help an attacker?

On an answer to the question How critical is it to keep your password length secret?, Mike Ounsworth commented that by storing the zxcvbn-calculated entropy of a password you make it easier for an ...
2
votes
3answers
2k views

how long does it take to brute force varying encryption standards?

Let's say I want to encrypt information in a database. What would be the best encryption algorithm to use and why. I was thinking AES, since it's widely used as a government standard, but if the ...
2
votes
1answer
110 views

Long passwords and key derivation functions

Not being a security expert, I have a rather theoratical question that I have been thinking about for quite a while now: Let's imagine an encryption software that takes a user-provided password, ...
2
votes
1answer
699 views

Is there an equation to calculate the number of instances of a series of characters exist in a given key space?

If I'm using 16-18 character-length passwords with 94 different possible values-per-character (lower alphas, upper alphas, numbers, and special characters), is there an equation I can use to calculate ...