An attack using every possible input to attempt to produce the correct output. Typically the method of last resort when no weakness allows the use of a more restricted input set. E.g. trying all possible (or likely) passwords, in an attempt to guess the correct one.

learn more… | top users | synonyms

5
votes
2answers
131 views

Is Twitter digits login (sms auth code) insecure?

Twitter released(some time ago) a new kit named Digits which allows the client to login with a phone number and an authorization code (received through sms). I find it great for the user experience ...
1
vote
1answer
57 views

Brute force a password with a lot of hash (of the same password)

I have a list of approximatively 1000 entities, defined using the following code : list[i] = md5_salt_unix_hash(random_salt, password) Where the random_salt is generated in each iteration and the ...
5
votes
1answer
53 views

Are these access.log entries successful wordpress login attempts?

I am hosting some wordpress sites on an apache 2.4 webserver, and I have discovered thousands of entries in my server logs like this: 221.219.219.248 - - [09/Mar/2015:03:29:25 +1300] "GET ...
1
vote
0answers
37 views

How to increase delay of ssh root access every time login fails [migrated]

Is there a way in Linux to delay, for example double the delay time, of the ssh root access every time an ssh root login fails from a given IP and them let the delay expire after X minutes of no login ...
12
votes
3answers
11k views

Why does Hydra return 16 valid passwords when none are valid?

I've been playing around with Hydra and DVWA and I've hit a bit of a snag - Hydra responds letting me know that the first 16 passwords in my password list are correct when none of them are. I assume ...
2
votes
0answers
33 views

Why does Hydra not stop when it finds a password? [closed]

Why does Hydra 8.1 not stop when it finds a password? I am using the -P option with a file that has over 5 Million passwords in it and the correct SSH password is located at approx. line 2100, but ...
0
votes
1answer
631 views

Testing Basic Authentication with ncrack

I'm conducting some basic pen testing against a page protected with Basic Authentication. I've sucessfully tested with Medusa and Hydra but am struggling to get the syntax correct for ncrack. The ...
4
votes
0answers
58 views

Random padding in hash functions

In this answer, it was recommended that you add random padding when hashing messages for a trusted timestamp, such as for predictions, in order to avoid dictionary and brute force attacks (at least ...
6
votes
3answers
65k views

Wordlists on Kali Linux?

I notice that in /usr/share/wordlists in Kali Linux (former Backtrack) there are some lists. Are they used to bruteforce something? Is there specific list for specific kind of attacks?
12
votes
1answer
17k views

Brute Forcing Password to a Truecrypt-encrypted file with Partial Knowledge

A while back, I encrypted a few files with Truecrypt, and stored the password in my head. Now I need to access it again, the password isn't working. I'm sure most of it is right, but I'm off by one or ...
2
votes
3answers
275 views

How can Facebook possibly stop a bruteforce attack on an account?

I've been doing some research on hacking recently and I found some very interesting tutorials on brute force cracking. I have some questions to ask and I'll be using Facebook as an example. Let's say ...
-2
votes
4answers
121 views

Getting password cracking time and byte storage from bruteforce?

I am stuck with this question, you can see it in the picture I have included below. PARTS (a and b) I know a-z will be 26^8, A-Z will be 26^8 guesses, and 0-9 will be 10^8 guesses. But I can't relate ...
0
votes
2answers
40 views

Library or service for rate limiting credit card transactions by IP [closed]

I have a simple product ordering form. A hacker is attempting to validate stolen credit card numbers by making two orders per minute with a bot. 99% of the orders are declined but some are ...
9
votes
4answers
5k views

In light of the FREAK TLS vulnerability, why do so many servers still offer RSA-EXPORT keys?

Ars Technica is reporting on a new attack against HTTPS. Called FREAK, the devices reported as vulnerable include iPhones, Android devices, and Macs running OS X. The attack (as has been clarified ...
2
votes
2answers
236 views

Temporarily save failed logins password hashes for using against brute force attack

My question is about online brute force attacks, that try to authenticate in the website. 1) For the first case if the requests are coming from the same ip, I think this are relatively easy as after ...
6
votes
2answers
9k views

Is it possible to crack a PIN / PUK code on a phone SIM card?

When deploying a mobile phone best practices policy, one of the points which were raised was the requirement for the user to protect his SIM card with a PIN. The theory is that three failed attempts ...
3
votes
2answers
1k views

Closely spaced failed logins in auth.log

I have a raspberry-pi (running GNU/Linux) and I recently allowed my router to forward port 22 (ssh) to the raspberry-pi so that I could log in while away from home. I then noticed a bunch of ...
4
votes
1answer
7k views

Is brute-forcing the only way to crack WPA?

I don't know much about how WPA algorithms work internally. Is brute-forcing an AP the only way to crack WPA? (or to get associated with AP) Another question is about Reaver-WPS, what if an access ...
1
vote
1answer
68 views

P12 private key vs private key file : what is more secure?

The question is a bit tricky because they don't have the same purpose but : Do both kind of file face the same security issue concerning private key protection : password strenght ? (PBKDF2 as both ...
-1
votes
4answers
15k views

Brute-force an SSH-login that has only a 4-letter password

Suppose, you know that a certain computer is only protected by such a short password, then you could just try every possible combination easily. How would a script look like, that tries to crack that ...
3
votes
3answers
14k views

Is it possible to brute force all 8 character passwords in an offline attack?

This article states: Brute-force techniques trying every possible combination of letters, numbers, and special characters had also succeeded at cracking all passwords of eight or fewer characters. ...
3
votes
3answers
234 views

Calculate time taken to break AES key

A 256 bit AES key is required to be broken using the brute force method on a 2GHz computer. How long would it take to break the key in the best case and in the worst case situations? Assume that 1000 ...
6
votes
2answers
119 views

Realistically, how much added security does having a passphrase on a ssh key have?

Let's assume ssh key brute force is unrealistic. It seems to me your greatest vulnerability would be someone gaining access to a client filesystem. If that's the case then key loggers and a host of ...
2
votes
1answer
39 views

Avoid brute-force enumeration of customers in a SaaS application

I'm involved in the development of a SaaS application. We host the application for different customers. A customer is a company. Each customer gets access to their hosted instance of the application ...
1
vote
2answers
76 views

Circumventing disadvantage of IP-based account lockout

So we're trying to prevent brute-force attacks on our web server login page--currently we just do IP-based locking if x failed attempts from IP address Y occur over z time period. After a security ...
5
votes
6answers
6k views

How can I generate custom brute-force dictionaries?

I have found during testing that companies often use variations of their names for critical passwords (for example Microsoft's password might be M1cr0s0f+ or m1cros0ft etc etc). So if I gave it the ...
1
vote
2answers
98 views

Session Hijacking through sessionId brute-forcing possible?

cookies usually contain a sessionId to keep track of a logged user. What would prevent a malicious user to forge millions of requests with random sessionIds and send them to a server, hoping to ...
0
votes
1answer
125 views

Can a botnet be used to effectively break encryption keys?

Can a botnet amass and coordinate enough computing power to break encryption keys that are typically considered to be secure (through brute force)? If this is the case, do we need to make our ...
6
votes
1answer
179 views

Can/do botnets brute force “high value” users of services like Gmail?

On an intranet a login is generally disabled after a very small number of failed logins. But a public email service like Gmail can't do the same, otherwise pranksters would just be continuously ...
6
votes
5answers
39k views

How to generete dictionary for brute force attack?

I need to crack my own password. Advantage is that I know possible characters and maximum length. What I need is to create dictionary for brute force attack. Dictionary should contain all the combos ...
0
votes
0answers
32 views

hydra password penetration test syntax [duplicate]

I am trying to penetrate a password on my own website using hydra. Let's say that I know login and password and i just put both there like in sample below: hydra -l admin -p password 123.123.123.123 ...
1
vote
1answer
96 views

Use THC hydra to make dictionary attack on localhost

I have programmed a log in in my webpage and now I want to test it against a dictionary attack. I am using Apache and my website is not online so to access it I connect to localhost/website In hydra I ...
0
votes
1answer
83 views

Why doesn't SSH use a better algorithm for encrypting keys?

According to the answers in this question, SSH still uses a very basic algorithm for encrypting keys with a passphrase, which can be attacked at a rate of billions tries per second using dedicated ...
0
votes
2answers
208 views

Scan all possible files on server (Brute force Filenames)

I'm not sure if I'm right here, but I just wanted to know if there is a tool that scans all possible filename combinations on a server and tells you what filenames the server responded to. So it would ...
0
votes
1answer
147 views

When bruteforcing a WiFi network password, Can that admin see it?

When bruteforcing a captured packet containing the encrypted password, can the owner/admin of the router see each auth attempt? I'm assuming you just encrypt each passphrase in the dictionary file and ...
0
votes
1answer
115 views

Brute force attacks detection risks

I would like to ask if using brute force attacks on some websites or online services can be risky in any way for the hacker? Let's say that someone is using medusa tool to crack password on his ...
0
votes
1answer
107 views

How to use multiple charsets in hashcat

I wanted to use a brute force attack on hashcat but WPA/WPA2 networks are 8-64 characters long and they have multiple possibilities of a password. I was wondering if there was a way to use multiple ...
1
vote
2answers
138 views

Adequate prevention of distributed brute force attacks?

What are good ways to prevent distributed brute force attacks on my website? I think (not sure. if someone can assure me, thanks!) my site is secure against normal brute force attacks as I am using ...
1
vote
2answers
247 views

Can Hydra crack a flash-based login?

Is it possible to brute force a flash login with hydra? If not, what is a good tool to pen test a flash login?
0
votes
0answers
115 views

THC-Hydra dictionary attack on JSP login form

I am trying to use Hydra to attack a JSP form but I have some confusion. Normally we use command something like this hydra -L list_user -P list_password HOST-ADDRESS http-post-form ...
0
votes
1answer
1k views

Hydra gives wrong answers

Problem: Hydra keeps giving me incorrect passwords every time. I'm using brute-force via Hydra to guess the correct password on a certain website. First of all I used BurpSuite to intercept the page ...
2
votes
1answer
1k views

Hydra bruteforce and JSON

I am having problems with Hydra and a JSON payload. The login request (intercepted with Fiddler), is the following: POST http://architectureservice.test.com/api/v1/login HTTP/1.1 Host: ...
1
vote
0answers
31 views

THC-Hydra - one good pass = shows all valid [duplicate]

As in title. I'm testing my router security and I came up with problem. hydra 192.168.0.1 http-get-form "/:un=^USER^&pw=^PASS^:User Name or Password is incorrect." -L usernames -P passwords ...
3
votes
1answer
192 views

Can a Windows or Linux password be brute-forced on a public network?

I am at a hotel that has a public network. I have a Windows machine with a wired connection to it. "Network and Sharing" has network discovery on. No folders are shared except "Users", which is shared ...
9
votes
2answers
155 views

What concrete parameters can I change to make my passphrase-protected private gpg key more secure

There are several questions which discuss the resistance of passphrase-protected private gpg keys against brute force attacks. It seems, this kind of discussion could go on forever. Rather than ...
14
votes
5answers
2k views

What is the difference between login throttling and temporary account lockout? [closed]

I am currently working on the redesign of a login page. I have initially suggested that login be throttled whereby pauses (incremental - in number of seconds) are introduced between each failed login ...
1
vote
0answers
4k views

Linux Hydra issue - random correct password success

I have an issue with Hydra when I use it. I have tried the same command lines given in guides directly supported by the Damn Vulnerable Web Application (DVWA) v1.8. Ok so.. here is my attempt ...
2
votes
1answer
73 views

Long passwords and key derivation functions

Not being a security expert, I have a rather theoratical question that I have been thinking about for quite a while now: Let's imagine an encryption software that takes a user-provided password, ...
0
votes
0answers
224 views

Can everyone find the pictures one sends over whatsapp?

I was trying out a whatsapp compatible chat application on my laptop. Someone sent me a picture and I received a link to that picture on the whatsapp server. Everyone who visits the link can see the ...
0
votes
1answer
336 views

Reporting an IP address

This morning while checking /var/log/secure to troubleshoot an issue with my Centos VPS, I found that there has been too many SSH bruteforce attempts from 54.93.174.60 for the past couple of days. I ...