An attack using every possible input to attempt to produce the correct output. Typically the method of last resort when no weakness allows the use of a more restricted input set. E.g. trying all possible (or likely) passwords, in an attempt to guess the correct one.

learn more… | top users | synonyms

0
votes
1answer
59 views

Is encryption less resistant to brute-forcing compared to hashing?

I understand that a hashing algorithm like bcrypt uses several rounds of hashing to make it computationally expensive for a brute-force attack. How does encryption work against a brute-force attack? I ...
0
votes
1answer
38 views

Can the aproximated date on which a given Encryption Algorithm will become prone to brute force be predicted?

I have a very elementary understanding about encryption so this question may have false assumptions, Lets take an encryption algorithm that is impractical to break through bruteforce with today's ...
0
votes
2answers
108 views

Bruteforcing blowfish

I am quite new to encryption and recently played around with blowfish (openssl's implemenation). I am using a 23 character password (case-sensitive alphanumeric random). I estimate the entropy to be ...
0
votes
1answer
98 views

What is the best way to generate a password/pin like string using brute force method? [closed]

I have a string of 7 characters. I'm supposed to generate all the combinations. But some combinations are more likely than others, I would like the more likely ones to be generated first. If I ...
0
votes
1answer
1k views

Hydra gives wrong answers

Problem: Hydra keeps giving me incorrect passwords every time. I'm using brute-force via Hydra to guess the correct password on a certain website. First of all I used BurpSuite to intercept the page ...
0
votes
1answer
209 views

THC Hydra 16 Valid Passwords? [duplicate]

So when i do hydra -l Admin -P "rockyou.txt" -s 80 192.168.13.1 http-get / it doesnt work for me, it says all 16 passwords are valid, but none of them works, can anyone help me with this? I tried ...
0
votes
3answers
118 views

User Account Guessing [duplicate]

I'm doing some research on user account guessing, and wanted to ask a question about some "bad practices". My thought is generally this is a trade-off between great user functionality/UX and ...
0
votes
2answers
88 views

Showing CAPTCHA

I'd like to show a CAPTCHA to prevent brute forcing attempts, but I was thinking of showing it whenever a user fails for an invalid username/password combination after X attempts, regardless of ...
0
votes
1answer
61 views

Find hash-function if original and hash are given? [duplicate]

I was thinking whether or not you can find the hash function(s) used if you have the original message and the hash. So assume that no salt is used during the hashing process, just multiple hashing and ...
0
votes
1answer
44 views

Does restarting an encrypted session increase security and deter attacks?

When a user initiates a SSH connection for example, keys are exchanged and a session is established with a new "passphrase" each time. If an attacker were to attempt to brute force this connection, ...
0
votes
0answers
61 views

Can everyone find the pictures one sends over whatsapp?

I was trying out a whatsapp compatible chat application on my laptop. Someone sent me a picture and I received a link to that picture on the whatsapp server. Everyone who visits the link can see the ...
0
votes
0answers
30 views

Why hydra doesn't return a valid username&password with a valid supplied username&password [migrated]

I'm just trying out hydra to test this case. I have php file running with apache web server named 'index.php' as following: <?php $login = 'admin'; $password = 'r00t'; ?> <html> ...
0
votes
0answers
18 views

Cracking WPA2 using Intel HD Graphics GPU [migrated]

I use Linux Kali and yesterday have captured a WPA handshake of my network. I want to crack it's password - but my CPU with aircrack-ng checks only about 2000 keys per second. In my laptop I have got ...
0
votes
0answers
206 views

Is the password “Z” more secure than the password “a”? [duplicate]

Okay, I guess it's not possible to call one-letter-passwords "secure" - so let's compare ZZZZZZZZZZ with aaaaaaaaaa. Both are using the same character pool [A-z], so the number of combinations for a ...
0
votes
0answers
56 views

My server has been brute forced what now? [duplicate]

I have installed a raspberry pi for fun at home. I opened the port 22 and this morning I was concerned about someone brute forcing my server. I ran this query : cd /var/log;zgrep ssh auth*|grep ...
0
votes
0answers
341 views

Testing Basic Authentication with ncrack

I'm conducting some basic pen testing against a page protected with Basic Authentication. I've sucessfully tested with Medusa and Hydra but am struggling to get the syntax correct for ncrack. the ...
0
votes
0answers
32 views

How can I determine the encryption used by knowing input and result? [duplicate]

Is it possible to determine the encryption or hash used if I know the original input and final output? There is a similar post here: Determine encoding/hashing methods used based on knowing the input ...
-1
votes
4answers
75 views

Confidentiality of file hashes

Context: I have a directory full of sensitive company files. I want to compare these files with a colleague at a remote location, without the need for a secure connection. Is it safe for me to ...
-1
votes
1answer
2k views

Hydra bruteforce is giving wrong passwords. Can't seem to work any help? [closed]

Ok so what im actually trying to do is to bruteforce my own account on some website just to check myself . This is NOT for illegal steps or use , im trying to crack my OWN password , and im trying to ...
-1
votes
1answer
213 views

How to prevent ddos and brute-force attack by restricting IP's on Wordpress website

I want to make wp-login.php and/or wp-admin accessible only from one country. If I want wp-login.php access only from USA then my approach from .htaccess is like below <Files wp-login.php> ...
-1
votes
1answer
125 views

Is there a benefit to encrypting a file multiple times? [duplicate]

If I had to store a text file with some confidential information on the cloud, would encrypting the file multiple times (say, 3) with different passwords using WinRAR (AES with a 256 bit key) provide ...
-1
votes
1answer
88 views

Where can I find good word list for MySQL 5? [closed]

I wonder where can I find good collections of dictionaries which can be used for MySQL 5 dictionary attack? I just need MySQL 5 word lists / dictionaries. I found a lot of MD5, SHA1, etc. but not ...
-1
votes
1answer
198 views

Cracking a 6-character alphanumeric password Windows dialog box

To put this problem in context, I have a touch monitor screen whose firmware program is protected by a password. The firmware program is downloaded over RS232 via a Windows utility program provided ...
-2
votes
4answers
11k views

Brute-force an SSH-login that has only a 4-letter password

Suppose, you know that a certain computer is only protected by such a short password, then you could just try every possible combination easily. How would a script look like, that tries to crack that ...
-2
votes
2answers
1k views

Can the U.S. goverment crack encryption? [closed]

Does USA government have the sufficient processing power to crack keys in matter of seconds? Let say 2048-bit RSA, for example. Since the RSA algorithm was developed by USA government (NSA?), I ...
-2
votes
2answers
5k views

What are the methods to crack WPA and WPA2? [closed]

Is there any method other than brute force and dictionary attacks to break WPA and WPA2?
-2
votes
1answer
1k views

How long does it take to crack a 100-letter long winrar password? [closed]

i´m interested in how long time it would take for a super computer dedicated to crack to crack a 100-letter long winrar password. The password contains Lowercase, Uppercase, Digits, ...
-2
votes
2answers
65 views

Strength of WPA passwords

How long would it take to crack an 8 letter (latin alphabet, lowercase) password of a WPA PSK network? Is it in reach of a single PC running hashCat?
-2
votes
1answer
726 views

LophtCrack version 6.0.12 is not auditing my Administrator password [closed]

I am using LophtCrack on my Windows 8 OS. I was testing my password strength and the problem I am seeing it is not working. It doesn't reveal my Admin password, I've run the process for half an hour. ...
-3
votes
3answers
14k views

How long will it take to crack a 10-15 character winrar password? [closed]

Ok, long story short, I'm currious how long it would take an agency to crack a 10-15 character winrar password. The file names in the archive are also scrambled including a word at the start and ...
-3
votes
2answers
147 views

Time it takes to crack a password on site like yahoo [closed]

I have a question. If you were using a password brute force/dictionary attack utility on a site like yahoo or another site, how long would it take to crack a password like Jah13Wootiang if Wootiang is ...
-3
votes
1answer
55 views

How many possible symbols and punctuations in a password? [closed]

I want to compute the possible combinations of a password consists of 8 digits of: alphabetical letters (26), numbers (0-9), symbols and punctuations. In order to compute this, I have to know the ...
-4
votes
7answers
855 views

Are passwords made up from concatenating a few foreign words better than shorter random characters? [duplicate]

Does it make sense to insert a foreign word into a paraphrase to mitigate against brute force? For example: "pussiMeansCatInEskimo" "caballoMeansHorse" "CatIsGatto" "SalopeMeansBitch" ...
-4
votes
1answer
496 views

Feasibility of brute-force on online password [closed]

I am familiar with how offline brute-force attacks work. But for online accounts, assuming no social engineering, how feasible is it to brute-force attack a password? For example, is this dependent ...