An attack using every possible input to attempt to produce the correct output. Typically the method of last resort when no weakness allows the use of a more restricted input set. E.g. trying all possible (or likely) passwords, in an attempt to guess the correct one.

learn more… | top users | synonyms

0
votes
1answer
17 views

Does stretching a hash increase a denial-of-service (DoS) risk and does brute-force protection mitigates that?

Disclaimer: I noticed several questions on this site but none really answer this two questions directly. Therefor I do not consider this duplicate. Personally I really like the article called Some ...
27
votes
12answers
5k views

Could I recover the content of file from its checksum/hash?

Let's say I have a video file that is split into multiple parts. Each piece is 2 Megabytes. I also have a list of the *insert hash name here* for each piece and also for the full file. Now assume ...
2
votes
2answers
39 views

How can SHA256-hashes as input to MD5 be revealed?

I know that you shouldn't use unsalted MD5 hashes of passwords in databases. But unfortunately, people do, see https://hashes.org/public.php. From this site I downloaded a file with passwords which ...
-3
votes
0answers
43 views

Dictionary File Generator for download [on hold]

I have seen in many different sites people searching by a good dictionary file or a good generator, I myself did that last week and didn't find good alternatives, so decided to code my own generator ...
0
votes
1answer
35 views

Windows Firewall: Restricted RDP to 1 IP, but still see login attempts from other IPs

I restricted the Firewall rules for RDP incoming restricting the Scope to 1 Remote IP address (Local IP Address section is empty). This was done for both Public & Private/Domain Rules. I did not ...
-1
votes
2answers
90 views

How secure is aes-256-cbc with a 40 char password

I'm using this command from this article to encrypt a file: openssl enc -aes-256-cbc -in /etc/services -out services.dat -k MYPASSWORD If MYPASSWORD is 40 characters in length, roughly how long ...
7
votes
3answers
1k views

Known Password Lengths and security considerations [duplicate]

Many people wil often brag about the length of their password, like "yeah nobody is ever going to crack my password cause its 22 characters long." I was thinking, if you knew the exact length of their ...
82
votes
9answers
16k views

Is it possible make brute-force attacks ineffective by giving false positive answers to failed log-in attempts?

I don't have any experience or scientific knowledge in security, I just wanted to ask if this is possible because I am interested in it. What if I encrypt data and every password decrypts it, but ...
9
votes
4answers
1k views

Is Twitter digits login (sms auth code) insecure?

Twitter released(some time ago) a new kit named Digits which allows the client to login with a phone number and an authorization code (received through sms). I find it great for the user experience ...
5
votes
3answers
27k views

What are the differences between dictionary attack and brute force attack?

Can someone explain the major differences between a Brute force attack and a Dictionary attack. Does the term rainbow table has any relation with these?
3
votes
4answers
21k views

How long would it take to bruteforce an AES-128 protected pdf knowing the key is 20 letter long and that the charset is A-Z,0-9?

The question says everything, knowing that a pdf is protected using standard Adobe password encryption that comes with Acrobat Pro (which as far as i know is AES 128) how much would it take to ...
1
vote
0answers
107 views

Find salt from md5 hash if password is known

I have a salted MD5 hash and I also know the password. How can I recover the salt using tools like John The Ripper (I have JTR jumbo installed)?
0
votes
1answer
246 views

Test a known list of possible Windows Remote Desktop credentials?

I've forgotten my password to my home server. It's a new Windows 2012R2 VM, I didn't change the maximum password age requirements in Group Policy DC (even tho I know I should have) until it was too ...
1
vote
1answer
14k views

Cracking a web form based logon with hydra [closed]

How do I have to use hydra on a web form? What I have done so far: I already successfully used hydra on a folder with an HTTP authentication: http://localhost/test/authtest/ with user admin and ...
0
votes
1answer
88 views

Robots trying to login to Azure VM when SSH port is closed in manager

I have many robots trying to do SSH login in a Azure VM. In the resource manager SSH is disabled but attacker IPs are public, as you can see below, where I copy a log for auth.log (I have an Ubuntu ...
0
votes
1answer
959 views

THC Hydra 16 Valid Passwords? [duplicate]

So when I do hydra -l Admin -P "rockyou.txt" -s 80 192.168.13.1 http-get / it doesn't work for me. It says all 16 passwords are valid, but none of them works. Can anyone help me with this? I tried ...
1
vote
2answers
97 views

Bruteforcing hardware-encrypted SSD

Can you bruteforce a hardware-encrypted SSD drive? I mean recovering the password needed to unlock the drive. Is there any software could do this? Here the focus is the software that could do the job....
4
votes
1answer
80 views

How secure is a Windows 10 PIN not needing enter?

I've searched around about Windows 10 PINs and although have seen a few answers regarding the security of them as a whole, I haven't found any discussing the fact that when I type in my PIN, the ...
0
votes
2answers
118 views

Why is it a problem to store strong passwords as unsalted hashes?

My users all have strong (80-bit true entropy) passwords. How do I know that? Because my imaginary website randomly generates the passwords for them (client-side). In that context, could you explain ...
2
votes
1answer
370 views

P12 private key vs private key file : what is more secure?

The question is a bit tricky because they don't have the same purpose but : Do both kind of file face the same security issue concerning private key protection : password strength? (PBKDF2 as both ...
0
votes
1answer
65 views

Is HTTP POST insecure?

Is it possible to perform a MITM attack or even bruteforce a HTTP POST? If so how does one perform an attack and how can a developer protect his/her site from such an attack?
0
votes
2answers
76 views

How would I brute-force a Bitlocker recovery key?

I have imaged a hard disk and used passware, but to no avail - it says Encryption key External key, and not the actual key. How do you think I would go about brute forcing it? Lets assume I had ...
1
vote
3answers
217 views

How to protect WordPress from brute-force attacks?

One of my WordPress sites is being constantly attacked with brute force. I have the WordFence and Clef plugins installed. The number of login attempts is limited to just one. The password is very ...
1
vote
0answers
77 views

RSA-1024 vs. DSA-1024: Claim DSA SSH key is much faster to brute force

Does the brute force speed vary significantly between 1024-bit RSA and DSA SSH keys? DSA like gpu keypairs are probably DSA/Elgamal? (Can't find docs) EDIT: The reason I ask is an instructor that "...
1
vote
1answer
60 views

Can I use John the Ripper to brute-force a password-protected flash drive?

I have a password-protected flash drive. The input window allows unlimited password attempts, but this form is not an encrypted file. Can I use John the Ripper to bruteforce the password?
14
votes
1answer
2k views

Understanding brute-forcing algorithms [duplicate]

I've been reading up on brute-forcing techniques and possible methods of prevention, but there is one issue that I haven't been able to find a clear answer to. The way I understand it, a 'simple' ...
4
votes
8answers
844 views

Does it take longer to brute force a password starting with z than one starting with a?

I was wondering about the following: If someone tries to get my password with Brute Force, will a password starting with "a" guessed faster than one starting with "z" ? In this case assume the ...
4
votes
3answers
1k views

Calculate time taken to break AES key

A 256 bit AES key is required to be broken using the brute force method on a 2GHz computer. How long would it take to break the key in the best case and in the worst case situations? Assume that 1000 ...
1
vote
0answers
42 views

Password guessing attack on file from SSD [closed]

I got the following scenario: a SSD self-encrypting drive (to be precise: a Samsung MZ7PD256HCGM) is encrypted using McAfee full-drive encryption (Opal 2.0 standard). I have a (relatively small) file ...
1
vote
0answers
54 views

Hydra hangs after 16 attempts

When I try to brute-force my router's admin page, Hydra is never making more than 16 attempts. After 16 attacks I receive only status updates with less and less tries per minute. Beside that, all ...
34
votes
7answers
4k views

How to know if a file is decrypted or not

For school, I have to do an exercise in which I have to decrypt files by brute force attack. There are a lot of different files in different file formats. The files have been encrypted using XOR or ...
0
votes
1answer
32 views

Attacking encrypted storage vs attacking memory [duplicate]

I want to create a generative password manager. Generative password managers generate passwords based on seeds such as the master password and the website's URL. In contrast, most password managers ...
-2
votes
1answer
156 views

Brute forcing using hydra

I'm try to do brute force attack on a system and I have complete word list of the possible passwords because they use a really simple format but when I tried hydra with the following post responses, ...
1
vote
1answer
62 views

Can LastPass local password store (on a Android device) be brute forced in a usual way?

I' trying to figure out how secure LastPass is if you have it on your Android device and it gets stolen. If I'm not mistaken there has to be a password vault stored somewhere locally on the device. ...
-4
votes
1answer
89 views

How long does it take to brute force a 7 character long password taken from 16 character set

A database file is encrypted with 256bits AES and the key is the first 7 characters (from the character set 0-9, a - f, all small letter) of MD5 hash . This implies 2^28 bits (268,435,456) possible ...
6
votes
2answers
270 views

Is there an equivalent of an Apple cryptochip in Android devices?

Apple has a cryptochip which, beside managing the encryption keys, tunnels authentication and provides throttling of failed attempts, as well as the ability to trigger a device wipe after several ...
5
votes
3answers
811 views

How can I restrict users' connection attempts to my FTP server?

Is there any way possible to restrict user to make a connection to the FTP server on my Windows XP computer? I have an FTP server established in Windows XP and now I want to make access to that FTP ...
3
votes
1answer
58 views

Is there value in slowing down retries on a fingerprint lock?

My phone has a fingerprint lock and it sometimes fails to identify my fingerprint (for example, if it wasn't positioned correctly). If I fail fingerprint identification 5 times in a row, I'm locked ...
36
votes
7answers
7k views

Is it possible to improve brute-force guessing of a password with a picture of the keyboard used to enter it?

Is it a bad idea to post a photo of your keyboard to social media? Can I look at a photo of a keyboard and determine the password of an account? Assuming a certain (set of) password(s) is the most ...
6
votes
1answer
133 views

Hydra when redirects

I'm using Hydra and I have trouble with this command: hydra 123.123.123.123 http-form-post \ "/se/login:j_username^USER^&j_password=^PASS^&submit=Log+in:/se/invalidLogin" \ -L /root/...
-5
votes
1answer
95 views

Time to break SHA-512 [closed]

From http://stackoverflow.com/questions/6776050/how-long-to-brute-force-a-salted-sha-512-hash-salt-provided, to break SHA-512 with brute force strategy, it require 3,17 * 10^64 years. It is almost ...
0
votes
0answers
38 views

Tool/Python script to generate word list [duplicate]

Is there a tool or specific Python script to performs the following to generate a word list: able to set minimum amount of letters such as 8 able to set maximum amount of letters such as 15 use ...
43
votes
4answers
33k views

Are salted SHA-256/512 hashes still safe if the hashes and their salts are exposed?

Scenario: a database of hashed and and salted passwords, including salts for each password, is stolen by a malicious user. Passwords are 6-10 chars long and chosen by non-technical users. Can this ...
1
vote
0answers
70 views

How to prevent DirBuster to stop listing apache server side files

I have deployed a php project on apache. When I use DirBuster tool to scan my site, it lists all server side files. I want to stop this listing. I have modified the permission. When I give the less ...
35
votes
8answers
4k views

Find matching phone numbers without actually knowing them

We have a mobile app that, given two users, needs to let them see what common contacts they have based on their phone numbers. How can we do this in a cryptographically secure way and respecting the ...
1
vote
0answers
42 views

DVWA hydra brute not matching

I am trying to brute force DVWA on low security. I disabled the first authentification as well. However when I ran my hydra script it doesn't match it with correct password. Here is my query hydra -l ...
4
votes
1answer
112 views

Spoofing an NTP server to allow bruteforce on any smartphone

We all know that smartphones (i'll take iPhone as an example) rely on SNTP/NTP servers to update a device's time and date. So, by creating an SNTP server that mimics Apple's server, we can actually ...
3
votes
3answers
126 views

Are login pages with no retry counts/lockouts a security risk?

I found a login page for a city/edu organisation that has no session times, no retry counter/lockout, and no delays if too many tries are made in a certain timeframe. I am able to exploit this to get ...
2
votes
2answers
215 views

Can You Brute Force Dropbox Folder URLs?

One can share folders with Dropbox by sending a URL with a hash in it. A recent article reported that user files were accessed by generating urls from common URL shortners. These URLs are typically ...
3
votes
1answer
627 views

Cracking a 6-character alphanumeric password Windows dialog box

To put this problem in context, I have a touch monitor screen whose firmware program is protected by a password. The firmware program is downloaded over RS232 via a Windows utility program provided ...