An attack using every possible input to attempt to produce the correct output. Typically the method of last resort when no weakness allows the use of a more restricted input set. E.g. trying all possible (or likely) passwords, in an attempt to guess the correct one.

learn more… | top users | synonyms

-3
votes
0answers
36 views

bruteforce computation assignment [on hold]

Assume you want to brute force a password of length 8, with characters in the range [a-zA-Z0-9]. Estimate the time required to test all passwords if you know the following about your system: SHA1 1 ...
0
votes
1answer
118 views

Test a known list of possible Windows Remote Desktop credentials?

I've forgotten my password to my home server. It's a new Windows 2012R2 VM, I didn't change the maximum password age requirements in Group Policy DC (even tho I know I should have) until it was too ...
26
votes
10answers
5k views

Could I recover the content of file from its checksum/hash?

Let's say I have a video file that is split into multiple parts. Each piece is 2 Megabytes. I also have a list of the *insert hash name here* for each piece and also for the full file. Now assume ...
1
vote
2answers
102 views

Are password-guessing attacks a real threat?

There are tons of questions, answers, articles, papers, cartoons etc. on the subject of how to choose a password in such a way that it's difficult to guess or crack with a dictionary-based attack. I ...
0
votes
3answers
177 views

How to (further) ensure SSH security?

I set up my Linux Ubuntu machine as an SSH server through no-ip.com and it works great. Recently I discovered the command, sudo lastb -ad -F -w which outputs a log of the most recent failed SSH ...
-1
votes
2answers
47 views

Is it possible to perform bruteforce attack with proxy on a website?

When one does brute force attack online, most probably the person will get caught easily,isn't there a way of doing brute force for example on a website without getting caught?
7
votes
5answers
32k views

Is it possible to brute force all 8 character passwords in an offline attack?

This article states: Brute-force techniques trying every possible combination of letters, numbers, and special characters had also succeeded at cracking all passwords of eight or fewer characters. ...
0
votes
0answers
31 views

Generate Custom Brute Force Dictionary from Partial Knowledge of Password [closed]

I'm trying to create a wordlist to brute force an old TrueCrypt volume I found. I have a hazy memory of what the password is, and I'm confident I can brute force it if I can get together a password ...
1
vote
1answer
276 views

Law enforcement cracked my phone?

Police took my android phone a few months ago. It was encrypted and had the 10 max tries destruction thing set on. I noticed that yesterday the device disappeared from my android device manager. ...
3
votes
1answer
19k views

Forgot password to 7-Zip archive

I think I already know the answer to this question, but I thought I'd ask the experts anyway. A few months back, I created a password-protected 7-Zip archive which housed the source code of a simple ...
1
vote
1answer
99 views

How to brute force HTTP Basic Authentication requested with XHR?

How can one brute force a website using HTTP Basic authentication using metasploit which uses XHR in background? I am getting error "No URI found that asks for HTTP authentication". Relevant headers ...
5
votes
1answer
144 views

Blocking Chinese IP addresses

I recently checked one of my servers' auth.log file and noticed some very suspicious activity. I recently shut down my server's ssh daemon, so the logs end on Jan 22, but what I noticed after ...
0
votes
1answer
57 views

Can a brute force attack be certainly prevented on a unix/linux shell?

I've been getting kind of curious about computer security. I know brute force has been discussed a fair bit on Stack, but I want to elaborate a bit by asking, "Is it possible to /certainly/ stop ...
2
votes
3answers
99 views

Nmap http-brute - Supplying arguments for bruting via GET

I'm attempting to brute a site in my test lab with Nmap's http-brute nse, which has the URL structure https://192.168.101.6/api/auth?email=a@b.com&password=pass Unfortunately Nmap's official ...
1
vote
1answer
103 views

How does encryption strength make a difference to an attacker

Take for example I have my social security and other personal information stored as a string that I am trying to encrypt on my local drive. My first method of encrypting the string is to use a ...
17
votes
1answer
23k views

Brute Forcing Password to a Truecrypt-encrypted file with Partial Knowledge

A while back, I encrypted a few files with Truecrypt, and stored the password in my head. Now I need to access it again, the password isn't working. I'm sure most of it is right, but I'm off by one or ...
0
votes
1answer
88 views

How to brute-force WPA-2 password of specific set of characters using oclHashcat?

I want to test oclHashcat on a WPA-2 PSK password of length 8 containing only characters in the set {a-z, A-Z, 0-9}. To do this I have already captured the handshake in a .cap file and converted it ...
1
vote
2answers
80 views

Exclude passwords with repeating letters

It would cut down a lot of time of the brute force attack if some of those passwords like "aaaaaa" wouldn't appear. How can this be achieved in Hydra or some other brute force software?
-1
votes
1answer
33 views

Brute forcing using hydra

I'm try to do brute force attack on a system and I have complete word list of the possible passwords because they use a really simple format but when I tried hydra with the following post responses, ...
7
votes
3answers
3k views

Why is it harder to brute force an iphone than a zip-file?

Having only 1,000,000 possible combinations, an encrypted zip-file with a 6-digit numeric password, could be brute force cracked within a second. But for an iphone (let's say iOS9 if it matters), it ...
53
votes
8answers
9k views

Am I experiencing a brute force attack?

When checking the auth log of a server with the command: grep sshd.\*Failed /var/log/auth.log | less I see thousands of lines like this: Jan 12 11:27:10 ubuntu-leno1 sshd[8423]: Failed ...
15
votes
5answers
64k views

How to generate dictionary for a dictionary attack?

I need to crack my own password. Advantage is that I know possible characters and maximum length. What I need is to create a dictionary. The dictionary should contain all the combos of characters ...
2
votes
1answer
93 views

Yii client side captcha validation

Apparently, Yii web application framework generates some kind of hash value from captcha codes it generates and sends it to the client side so it can be used for client side validation of the captcha ...
3
votes
2answers
114 views

Is there known statistics of passwords used during brute force password attacks?

I have been reading quite a bit about brute force attacks and I am wondering whether the passwords that are used in such attacks should be kept around so as to later prevent my users from having those ...
6
votes
2answers
547 views

Why do so many cracking attempts originate from China?

I recently put a Linux server online and it didn't take long until I had the first attempts to brute-force the SSH login. It's not that I am worried about that - I trust the security of my server. But ...
5
votes
1answer
158 views

Is there an equivalent of an Apple cryptochip in Android devices?

Apple has a cryptochip which, beside managing the encryption keys, tunnels authentication and provides throttling of failed attempts, as well as the ability to trigger a device wipe after several ...
30
votes
8answers
5k views

Do non-keyboard characters make my password less susceptible to brute forcing?

I can put characters in my password for which there are no keys on a keyboard. On Windows, Alt+#### (with the numpad) inserts the character for whatever code you type in. When I put this in a ...
5
votes
4answers
707 views

Can't brute force password cracking somehow be throttled?

Online articles mention the importance of a strong password and suggest that hacking tools allows bad guys to attempt millions of passwords per second. I am wondering why OSes and websites and such ...
3
votes
0answers
27 views

Reaver stuck at flow_handler

I tried to run Reaver against my router at home using an Ubuntu 15.10 laptop. The command used was: sudo reaver -i mon0 -b XX:XX:XX:XX:XX:XX -vv -c 7 -a (the channel I got from aerodump-ng). I'm ...
2
votes
0answers
34 views

Customize John The Ripper BF technique

Is it possible for me to customize the way John the Ripper brute forces a .cap file? I, knowing my WiFi password, want to crack it fast as possible (no hit with word list). Can I customize John to ...
1
vote
1answer
64 views

Is it secure to allow an account to use `test123!` as their password?

I'm working on tightening up security for the auth layer of my app and I'm currently making a call on the complexity I'll require for passwords. Is there a 'standard' recommendation for complexity? ...
1
vote
0answers
41 views

trapdoor information with hash functions

I have been playing with an idea for the past few days. I have been unable to find information on here or crypto.stackexchange about using trapdoor information in the input to a hash function. ...
1
vote
1answer
87 views

SSH Key vs Complex Password with Fail2Ban & Two Factor Authentication

Normally you hear that using an SSH Key is far more secure than using a regular password. However I've been wondering if this statement is really true. Let's say we have the following variables for ...
20
votes
7answers
3k views

Are reCAPTCHA enough to prevent brute-force password guesses?

I was wondering if reCAPTCHA were strong enough to prevent BruteForce from bots or if I needed to add more security, such as sending a unique mail to the user every 5 tries that someone try to log on ...
7
votes
2answers
80 views

Is lack of wildcard DNS entry a security vulnerability?

A friend of a friend received an email from a security researcher that looks legit. Researcher submitted several vulnerabilities, one of the them reads like this Vulnerability # ... Title : ...
-2
votes
1answer
118 views

Can someone bruteforce my OSX? (Macbook)

Is it possible for someone to bruteforce or perform a dictionary attack on a Macbook? It's very easy to bypass security of a Windows box (Password Protection) , what is the difficulty level of ...
-1
votes
2answers
110 views

Hydra producing fake login passwords

I'm trying to "hack" (login) into my own HTTPS website account through Hydra. Therefore, it is 100% legal. Hydra keeps producing tons of incorrect passwords. This is the code I use: hydra -v -V -l ...
9
votes
4answers
113k views

Wordlists on Kali Linux?

I notice that in /usr/share/wordlists in Kali Linux (former Backtrack) there are some lists. Are they used to bruteforce something? Is there specific list for specific kind of attacks?
1
vote
3answers
391 views

Adequate prevention of distributed brute force attacks?

What are good ways to prevent distributed brute force attacks on my website? I think (not sure. if someone can assure me, thanks!) my site is secure against normal brute force attacks as I am using ...
0
votes
0answers
70 views

Hydra command for cracking a webpage which uses <span> tag for failed login attempts

I'm trying to for crack a simple webform for testing hydra in Kali. When the webpage encounters a wrong username and password combination it pops up a message using the following html code:: ...
-1
votes
1answer
132 views

ISP has informed us that our server is launching brute force attacks on WordPress sites, how do we end this? [duplicate]

Misc Situation: -Server login is obtained by hacker, hacker places malicious brute force file in /hacked/bruteforce/ -Server password is then changed, hacker can still run script by navigating to ...
1
vote
1answer
56 views

How effective are firewall rate limiting rules for slowing down brute force and DOS attacks?

I am investigating methods to slow down the rate at which attackers can make brute force attempts against my webserver's SSH and HTTP services. I have come across many articles as well as the ...
1
vote
0answers
52 views

How secure is Asus router latest framework function: “Added protection mechanism for GUI login brute-force attack for login username and password.”?

I have just updated my RT-N12 D1 router to the latest framework, and it has new function - "Added protection mechanism for GUI login brute-force attack for login username and password.". I Googled and ...
1
vote
2answers
125 views

Why do websites force the user to use a long and complicated password when brute force isn't possible?

if you have a phone with 4-digit pin and the phone does not get locked no matter how many times you put the wrong pin it makes sense to use 10 or 16 digits as it'll increase the time the attacker ...
3
votes
2answers
6k views

How long it will take to crack a RAR password?

I wonder how long it will take to crack 16 character alphanumeric WinRAR password for a mini supercomputer. As far as I know graphic cards are preferred over CPUs to crack passwords nowadays. If we ...
2
votes
2answers
170 views

How can I make wordlist smaller size?

I've been thinking if I create numeric 8chars wordlist and then compress it, can I directly input compressed wordlist into aircrack-ng or is there a way to make a smaller size wordlist, because if I ...
4
votes
3answers
266 views

Can using emojis make someone's password safer?

I was just thinking about this the other day, after reading about making safe passwords, you have a few options: The first would be, adding numbers, or something other than just a word ...
8
votes
5answers
60k views

Bruteforce on 10 characters length WPA2 password

I'm trying to hack my own WPA2 network for learning purposes. I have the *.cap file generated by aircrack-ng tools after a WPA handshake. I've tested by including my own password and a bunch of ...
2
votes
2answers
79 views

REST Services: Limiting the concurrency of a login endpoint

Scenario: A botnet is recruited to try to authenticate against a website or service with each bot trying infrequently using a common password and a list of 'real' email addresses, avoiding the ...
42
votes
3answers
60k views

How to estimate the time needed to crack RSA encryption?

How to estimate the time needed to crack RSA encryption? I mean the time needed to crack Rsa encryption with key length of 1024, 2048, 3072, 4096, 5120, 6144, 5120, 7168, 8192, 9216, 10240, 11264, ...