An attack using every possible input to attempt to produce the correct output. Typically the method of last resort when no weakness allows the use of a more restricted input set. E.g. trying all possible (or likely) passwords, in an attempt to guess the correct one.

learn more… | top users | synonyms

0
votes
2answers
707 views

Bruteforce Passphrase of Dictionary Words

Consider the all lowercase passphrase: "lazy fox haggles treaty" Assume all four words are in a dictionary of 2000. Bruteforcing word combinations, how long does it take to crack this password at ...
0
votes
2answers
5k views

What are the methods to crack WPA and WPA2? [closed]

Is there any method other than brute force and dictionary attacks to break WPA and WPA2?
0
votes
1answer
370 views

When bruteforcing a WiFi network password, Can that admin see it?

When bruteforcing a captured packet containing the encrypted password, can the owner/admin of the router see each auth attempt? I'm assuming you just encrypt each passphrase in the dictionary file and ...
0
votes
1answer
246 views

Can a botnet be used to effectively break encryption keys?

Can a botnet amass and coordinate enough computing power to break encryption keys that are typically considered to be secure (through brute force)? If this is the case, do we need to make our ...
0
votes
1answer
13k views

Cracking a web form based logon with hydra [closed]

How do I have to use hydra on a web form? What I have done so far: I already successfully used hydra on a folder with an HTTP authentication: http://localhost/test/authtest/ with user admin and ...
0
votes
1answer
136 views

Brute force a hard drive when most of the password is known

I need to access a hard drive that is encrypted with LUKS. The password provided is incorrect, however it is only incorrect by a character or so. The password itself is very strong and above 30 ...
0
votes
2answers
247 views

Do you need more then 128bit entropy

UUID use 128 bit numbers. Currently it is not feasible to randomly produce two UUIDs that are the same. Does that means 128 bits of entropy is suitable for all cryptographic operations? I would ...
0
votes
2answers
85 views

Library or service for rate limiting credit card transactions by IP [closed]

I have a simple product ordering form. A hacker is attempting to validate stolen credit card numbers by making two orders per minute with a bot. 99% of the orders are declined but some are ...
0
votes
4answers
189 views

Confidentiality of file hashes

Context: I have a directory full of sensitive company files. I want to compare these files with a colleague at a remote location, without the need for a secure connection. Is it safe for me to ...
0
votes
2answers
119 views

How do you overcome the problem of the salt being public and known by the attacker? [duplicate]

I believe that when adding a salt to the password you need to store the values so you can compute the hash again. But, what does happen if the attacker get the salt? How is it possible to add value ...
0
votes
1answer
74 views

Is encryption less resistant to brute-forcing compared to hashing?

I understand that a hashing algorithm like bcrypt uses several rounds of hashing to make it computationally expensive for a brute-force attack. How does encryption work against a brute-force attack? I ...
0
votes
3answers
28k views

How long will it take to crack a 10-15 character winrar password? [closed]

Ok, long story short, I'm currious how long it would take an agency to crack a 10-15 character winrar password. The file names in the archive are also scrambled including a word at the start and ...
0
votes
1answer
86 views

Can a brute force attack be certainly prevented on a unix/linux shell?

I've been getting kind of curious about computer security. I know brute force has been discussed a fair bit on Stack, but I want to elaborate a bit by asking, "Is it possible to /certainly/ stop ...
0
votes
1answer
67 views

Can an old fashioned crypt encrypted file be brute forced, if so how?

If I encrypt a file using the old Unix/Linux crypt() function, how can it be decrypted or attacked? I understand how a password file (for example) is attacked, you guess passwords, run them through ...
0
votes
1answer
126 views

Ignoring collision and (second) pre-image resistance, what makes a cryptographic hash function strong?

With regards to resistance against dictionary and brute-force attacks to "crack" hashes containing passwords, what determines the resistance of a cryptographic hash function? Since collision ...
0
votes
1answer
117 views

Why doesn't SSH use a better algorithm for encrypting keys?

According to the answers in this question, SSH still uses a very basic algorithm for encrypting keys with a passphrase, which can be attacked at a rate of billions tries per second using dedicated ...
0
votes
2answers
1k views

Bruteforcing blowfish

I am quite new to encryption and recently played around with blowfish (openssl's implemenation). I am using a 23 character password (case-sensitive alphanumeric random). I estimate the entropy to be ...
0
votes
1answer
217 views

What is the best way to generate a password/pin like string using brute force method? [closed]

I have a string of 7 characters. I'm supposed to generate all the combinations. But some combinations are more likely than others, I would like the more likely ones to be generated first. If I ...
0
votes
1answer
2k views

Hydra gives wrong answers

Problem: Hydra keeps giving me incorrect passwords every time. I'm using brute-force via Hydra to guess the correct password on a certain website. First of all I used BurpSuite to intercept the page ...
0
votes
3answers
125 views

Protect WordPress from brute force attacks?

One of my WordPress sites is being constantly attacked with brute force. I have the WordFence and Clef plugins installed. The number of login attempts is limited to just one. The password is very ...
0
votes
2answers
195 views

Cracking a password Protected pdf file using John the ripper

What exactly happens after I provide the hash from the pdf file to John for cracking the password? Does John extract just the password hash from the file and work on it, or is there something else?
0
votes
1answer
186 views

Why IOS on IPhone cannot be brute-forced programatically? [duplicate]

I am interested in the recent Apple case where FBI wants to get access, but they say it's not technically possible other than creating a new OS (or I guess just modifying the existing one). More ...
0
votes
1answer
242 views

How to brute-force WPA-2 password of specific set of characters using oclHashcat?

I want to test oclHashcat on a WPA-2 PSK password of length 8 containing only characters in the set {a-z, A-Z, 0-9}. To do this I have already captured the handshake in a .cap file and converted it ...
0
votes
1answer
114 views

Prevent brute force attacks on web publishing logins

Presumably, if someone tries to brute force into your website's control panel at your web host's site - they will be throttled/locked-out etc. But what about the web publishing logins (Web-Deploy, ...
0
votes
2answers
398 views

Brute force time estimation - random sequence

I would like to ask if there are 2^1000 possibilities to choose from, how long would it take go through them all on average? (in terms of min, hours or years) Note: This is not necessary related to ...
0
votes
2answers
4k views

Scan all possible files on server (Brute force Filenames)

I'm not sure if I'm right here, but I just wanted to know if there is a tool that scans all possible filename combinations on a server and tells you what filenames the server responded to. So it would ...
0
votes
1answer
2k views

How to use multiple charsets in hashcat

I wanted to use a brute force attack on hashcat but WPA/WPA2 networks are 8-64 characters long and they have multiple possibilities of a password. I was wondering if there was a way to use multiple ...
0
votes
1answer
881 views

THC Hydra 16 Valid Passwords? [duplicate]

So when i do hydra -l Admin -P "rockyou.txt" -s 80 192.168.13.1 http-get / it doesnt work for me, it says all 16 passwords are valid, but none of them works, can anyone help me with this? I tried ...
0
votes
3answers
284 views

User Account Guessing [duplicate]

I'm doing some research on user account guessing, and wanted to ask a question about some "bad practices". My thought is generally this is a trade-off between great user functionality/UX and ...
0
votes
2answers
238 views

Showing CAPTCHA

I'd like to show a CAPTCHA to prevent brute forcing attempts, but I was thinking of showing it whenever a user fails for an invalid username/password combination after X attempts, regardless of ...
0
votes
1answer
82 views

Find hash-function if original and hash are given? [duplicate]

I was thinking whether or not you can find the hash function(s) used if you have the original message and the hash. So assume that no salt is used during the hashing process, just multiple hashing and ...
0
votes
1answer
2k views

Testing Basic Authentication with ncrack

I'm conducting some basic pen testing against a page protected with Basic Authentication. I've sucessfully tested with Medusa and Hydra but am struggling to get the syntax correct for ncrack. The ...
0
votes
1answer
50 views

Does restarting an encrypted session increase security and deter attacks?

When a user initiates a SSH connection for example, keys are exchanged and a session is established with a new "passphrase" each time. If an attacker were to attempt to brute force this connection, ...
0
votes
0answers
38 views

Tool/Python script to generate word list [duplicate]

Is there a tool or specific Python script to performs the following to generate a word list: able to set minimum amount of letters such as 8 able to set maximum amount of letters such as 15 use ...
0
votes
0answers
24 views

DVWA hydra brute not matching

I am trying to brute force DVWA on low security. I disabled the first authentification as well. However when I ran my hydra script it doesn't match it with correct password. Here is my query hydra -l ...
0
votes
0answers
19 views

Cyrus-Imap (v2.3.16) local logon attack

CentOS-6.7 Cyrus-IMAP-2.3.16 The host inet07.hamilton.harte-lyne.ca is our IMAP server host. It offers imap and pop3 publicly. I uses local accounts (/etc/passwd) for imap/pop3 authentication ...
0
votes
0answers
33 views

What is a straightforward way to brute force CLI applications?

This is a question to maybe more CTF-experienced guys among you. I wonder how you generally brute force a simple CLI application. For example if you have an application which tells you a user's data ...
0
votes
0answers
96 views

Hydra command for cracking a webpage which uses <span> tag for failed login attempts

I'm trying to for crack a simple webform for testing hydra in Kali. When the webpage encounters a wrong username and password combination it pops up a message using the following html code:: ...
0
votes
1answer
220 views

ISP has informed us that our server is launching brute force attacks on WordPress sites, how do we end this? [duplicate]

Misc Situation: -Server login is obtained by hacker, hacker places malicious brute force file in /hacked/bruteforce/ -Server password is then changed, hacker can still run script by navigating to ...
0
votes
1answer
181 views

Test a known list of possible Windows Remote Desktop credentials?

I've forgotten my password to my home server. It's a new Windows 2012R2 VM, I didn't change the maximum password age requirements in Group Policy DC (even tho I know I should have) until it was too ...
0
votes
0answers
116 views

Would it take long to brute force a md5 hash like this?

1be8917510-36.51929856278002 10bce1af27-99.18403192423284 103fa11cc6-87.21158325206488 Few examples above and as you can see the pattern is: 1xxxxxxxxx-{a percentage (0-100) to 14 decimal places} ...
0
votes
0answers
37 views

hydra password penetration test syntax [duplicate]

I am trying to penetrate a password on my own website using hydra. Let's say that I know login and password and i just put both there like in sample below: hydra -l admin -p password 123.123.123.123 ...
0
votes
0answers
216 views

Is the password “Z” more secure than the password “a”? [duplicate]

Okay, I guess it's not possible to call one-letter-passwords "secure" - so let's compare ZZZZZZZZZZ with aaaaaaaaaa. Both are using the same character pool [A-z], so the number of combinations for a ...
0
votes
0answers
1k views

Brute-Force/Dictionary attack against encypted file using PBKDF2 key derivation

I have been following this very useful post by Thomas. My use case is slightly different. I am developing a mobile application which requires some sensitive data to be stored on the device in a SQLite ...
0
votes
0answers
38 views

How can I determine the encryption used by knowing input and result? [duplicate]

Is it possible to determine the encryption or hash used if I know the original input and final output? There is a similar post here: Determine encoding/hashing methods used based on knowing the input ...
-1
votes
1answer
10k views

Has the WPS brute-force cracking issue been fixed?

I have heard a rumor that the WPS brute force attack doesn't work on newer devices, and that you now have to try all 10^7 PINs to find the correct one. Is that true?
-1
votes
1answer
6k views

Hydra bruteforce is giving wrong passwords. Can't seem to work any help? [closed]

Ok so what im actually trying to do is to bruteforce my own account on some website just to check myself . This is NOT for illegal steps or use , im trying to crack my OWN password , and im trying to ...
-1
votes
1answer
409 views

Brute force attacks detection risks

I would like to ask if using brute force attacks on some websites or online services can be risky in any way for the hacker? Let's say that someone is using medusa tool to crack password on his ...
-1
votes
1answer
2k views

How long does it take to crack a 100-letter long winrar password? [closed]

i´m interested in how long time it would take for a super computer dedicated to crack to crack a 100-letter long winrar password. The password contains Lowercase, Uppercase, Digits, ...
-1
votes
1answer
913 views

How to prevent ddos and brute-force attack by restricting IP's on Wordpress website

I want to make wp-login.php and/or wp-admin accessible only from one country. If I want wp-login.php access only from USA then my approach from .htaccess is like below <Files wp-login.php> ...