An attack using every possible input to attempt to produce the correct output. Typically the method of last resort when no weakness allows the use of a more restricted input set. E.g. trying all possible (or likely) passwords, in an attempt to guess the correct one.

learn more… | top users | synonyms

1
vote
1answer
4k views

How to use http-get-form in THC-Hydra?

I've been messing with Hydra (Brute Force) to solve the "Damn Vulnerable Web App" brute force section but the problem is when I use http-get-form it said: Warning: child 1 seems to have died, ...
1
vote
0answers
118 views

Hydra gives wrong passwords

I've been trying to use hydra (educational way) but with no success. The site method is http-post but performed by ajax (should it be a problem? I think not). After execute the command I got an output ...
1
vote
1answer
99 views

Distributed IMAP-Dictionary-Attack-Tool?

I have a client with a hacked IMAP-Account, and the attacker(s) made thousands of password-attempts, probably with a fixed set of passwords, from different IPs before they got in. After successful ...
1
vote
0answers
336 views

BruteForce on Hydra (Usernames or Password with Special-Chars), letter “Ñ”

I use Hydra with the Web-Form (Http-Post-Form); and I'm trying to use a list of Usernames when some of the nicks contain a letter ñ. For example I have the following account in my list: Username: ...
1
vote
0answers
2k views

Linux Hydra issue - random correct password success

I have an issue with Hydra when i use it. First let me inform that, i read multible guides, tries the excact same command lines as in guides directly supported by the Damn Vulnerable Web Application ...
1
vote
1answer
440 views

Brute Forcing Domain Controller

I have a MS-Server2K3 domain controller that also serves as a Exchange server. Due to recent network speed loss and issues I began looking at event logs and noticed an exceptionally large number of ...
0
votes
2answers
311 views

Bruteforce Passphrase of Dictionary Words

Consider the all lowercase passphrase: "lazy fox haggles treaty" Assume all four words are in a dictionary of 2000. Bruteforcing word combinations, how long does it take to crack this password at ...
0
votes
1answer
107 views

How can brute force scripts tell once they're found the correct key?

If you have a random block of data and you encrypt it with a key, how can a brute force script tell when it has found the correct key? Is it possible without some sort of reference to the original ...
0
votes
2answers
56 views

How do you overcome the problem of the salt being public and known by the attacker? [duplicate]

I believe that when adding a salt to the password you need to store the values so you can compute the hash again. But, what does happen if the attacker get the salt? How is it possible to add value ...
0
votes
1answer
48 views

Is encryption less resistant to brute-forcing compared to hashing?

I understand that a hashing algorithm like bcrypt uses several rounds of hashing to make it computationally expensive for a brute-force attack. How does encryption work against a brute-force attack? I ...
0
votes
1answer
53 views

What is the best way to generate a password/pin like string using brute force method? [closed]

I have a string of 7 characters. I'm supposed to generate all the combinations. But some combinations are more likely than others, I would like the more likely ones to be generated first. If I ...
0
votes
1answer
475 views

Hydra gives wrong answers

Problem: Hydra keeps giving me incorrect passwords every time. I'm using brute-force via Hydra to guess the correct password on a certain website. First of all I used BurpSuite to intercept the page ...
0
votes
1answer
41 views

Does restarting an encrypted session increase security and deter attacks?

When a user initiates a SSH connection for example, keys are exchanged and a session is established with a new "passphrase" each time. If an attacker were to attempt to brute force this connection, ...
0
votes
2answers
447 views

Securing anonymous accessible URL with a GUID segment?

In my problem there is an existing system that works as a alerting or clipping service that runs user defined searches and generates results lists. These are setup by authenticated users and this ...
0
votes
0answers
46 views

Brute-Force/Dictionary attack against encypted file using PBKDF2 key derivation

I have been following this very useful post by Thomas. My use case is slightly different. I am developing a mobile application which requires some sensitive data to be stored on the device in a SQLite ...
0
votes
0answers
28 views

Firewall best practice

I have to implement a firewall on a Mikrotik RouterBoard. What is a good way to do it? Here is my plan: Note: We are using an OpenVPN (bridge mode) server, a DHCP server, a PPPOE client, and an NTP ...
0
votes
0answers
31 views

How can I determine the encryption used by knowing input and result? [duplicate]

Is it possible to determine the encryption or hash used if I know the original input and final output? There is a similar post here: Determine encoding/hashing methods used based on knowing the input ...
-1
votes
3answers
2k views

Number of AES-256 operations per second on a maximized Cray XE6

How many FLOPs does one AES-256 operation take in ECB mode? How many AES-256 operations in ECB mode can a maximized Cray XE6 perform per second? Cray states that it can be scaled to over 1 million ...
-1
votes
1answer
584 views

Hydra bruteforce is giving wrong passwords. Can't seem to work any help? [closed]

Ok so what im actually trying to do is to bruteforce my own account on some website just to check myself . This is NOT for illegal steps or use , im trying to crack my OWN password , and im trying to ...
-2
votes
4answers
5k views

How do i brute-force an SSH-login which has an only 4-letter password?

Suppose, you know that a certain computer is only protected by such a short password, then you could just try every possible combination easily. How would a script look like, that tries to crack that ...
-2
votes
6answers
572 views

Are passwords made up from concatenating a few foreign words better than shorter random characters?

Does it make sense to insert a foreign word into a paraphrase to mitigate against brute force? For example: "pussiMeansCatInEskimo" "caballoMeansHorse" "CatIsGatto" "SalopeMeansBitch" ...
-2
votes
2answers
1k views

Can the U.S. goverment crack encryption? [closed]

Does USA government have the sufficient processing power to crack keys in matter of seconds? Let say 2048-bit RSA, for example. Since the RSA algorithm was developed by USA government (NSA?), I ...
-2
votes
1answer
4k views

Has the WPS brute-force cracking issue been fixed?

I have heard a rumor that the WPS brute force attack doesn't work on newer devices, and that you now have to try all 10^7 PINs to find the correct one. Is that true?
-2
votes
1answer
620 views

How long does it take to crack a 100-letter long winrar password? [closed]

i´m interested in how long time it would take for a super computer dedicated to crack to crack a 100-letter long winrar password. The password contains Lowercase, Uppercase, Digits, ...
-2
votes
2answers
4k views

What are the methods to crack WPA and WPA2? [closed]

Is there any method other than brute force and dictionary attacks to break WPA and WPA2?
-2
votes
0answers
35 views

How vulnerable is Windows 7 to brute force attacks?

I researched a while back whether it would be feasible for a standard user to be able to brute force another account on Windows 7. I calculated that at 3,000 attempts per second, it would take 11 days ...
-2
votes
1answer
538 views

LophtCrack version 6.0.12 is not auditing my Administrator password [closed]

I am using LophtCrack on my Windows 8 OS. I was testing my password strength and the problem I am seeing it is not working. It doesn't reveal my Admin password, I've run the process for half an hour. ...
-3
votes
3answers
7k views

How long will it take to crack a 10-15 character winrar password? [closed]

Ok, long story short, I'm currious how long it would take an agency to crack a 10-15 character winrar password. The file names in the archive are also scrambled including a word at the start and ...
-3
votes
1answer
29 views

How many possible symbols and punctuations in a password? [closed]

I want to compute the possible combinations of a password consists of 8 digits of: alphabetical letters (26), numbers (0-9), symbols and punctuations. In order to compute this, I have to know the ...
-4
votes
1answer
397 views

Feasibility of brute-force on online password [closed]

I am familiar with how offline brute-force attacks work. But for online accounts, assuming no social engineering, how feasible is it to brute-force attack a password? For example, is this dependent ...