An attack using every possible input to attempt to produce the correct output. Typically the method of last resort when no weakness allows the use of a more restricted input set. E.g. trying all possible (or likely) passwords, in an attempt to guess the correct one.

learn more… | top users | synonyms

-1
votes
2answers
85 views

How secure is aes-256-cbc with a 40 char password

I'm using this command from this article to encrypt a file: openssl enc -aes-256-cbc -in /etc/services -out services.dat -k MYPASSWORD If MYPASSWORD is 40 characters in length, roughly how long ...
-1
votes
2answers
264 views

Is it possible to perform bruteforce attack with proxy on a website?

When one does brute force attack online, most probably the person will get caught easily,isn't there a way of doing brute force for example on a website without getting caught?
-1
votes
2answers
114 views

Strength of WPA passwords

How long would it take to crack an 8 letter (latin alphabet, lowercase) password of a WPA PSK network? Is it in reach of a single PC running hashCat?
1
vote
1answer
1k views

Distributed IMAP-Dictionary-Attack-Tool?

I have a client with a hacked IMAP-Account, and the attacker(s) made thousands of password-attempts, probably with a fixed set of passwords, from different IPs before they got in. After successful ...
0
votes
1answer
33 views

Windows Firewall: Restricted RDP to 1 IP, but still see login attempts from other IPs

I restricted the Firewall rules for RDP incoming restricting the Scope to 1 Remote IP address (Local IP Address section is empty). This was done for both Public & Private/Domain Rules. I did not ...
0
votes
1answer
88 views

Robots trying to login to Azure VM when SSH port is closed in manager

I have many robots trying to do SSH login in a Azure VM. In the resource manager SSH is disabled but attacker IPs are public, as you can see below, where I copy a log for auth.log (I have an Ubuntu ...
0
votes
1answer
242 views

Test a known list of possible Windows Remote Desktop credentials?

I've forgotten my password to my home server. It's a new Windows 2012R2 VM, I didn't change the maximum password age requirements in Group Policy DC (even tho I know I should have) until it was too ...
-4
votes
1answer
88 views

How long does it take to brute force a 7 character long password taken from 16 character set

A database file is encrypted with 256bits AES and the key is the first 7 characters (from the character set 0-9, a - f, all small letter) of MD5 hash . This implies 2^28 bits (268,435,456) possible ...
3
votes
0answers
38 views

Reaver stuck at flow_handler

I tried to run Reaver against my router at home using an Ubuntu 15.10 laptop. The command used was: sudo reaver -i mon0 -b XX:XX:XX:XX:XX:XX -vv -c 7 -a (the channel I got from aerodump-ng). I'm ...
2
votes
0answers
55 views

How rf remotes for “cloning” rolling code find matching codes?

I've been tinkering with a rf (garage door) remote control that has a scanner mode (google JMA SR-48 for details). This mode works for Mutancode and Erreka which I assume would be similar to KeeLoq. ...
2
votes
0answers
45 views

Customize John The Ripper BF technique

Is it possible for me to customize the way John the Ripper brute forces a .cap file? I, knowing my WiFi password, want to crack it fast as possible (no hit with word list). Can I customize John to ...
1
vote
0answers
104 views

Find salt from md5 hash if password is known

I have a salted MD5 hash and I also know the password. How can I recover the salt using tools like John The Ripper (I have JTR jumbo installed)?
1
vote
0answers
75 views

RSA-1024 vs. DSA-1024: Claim DSA SSH key is much faster to brute force

Does the brute force speed vary significantly between 1024-bit RSA and DSA SSH keys? DSA like gpu keypairs are probably DSA/Elgamal? (Can't find docs) EDIT: The reason I ask is an instructor that "...
1
vote
0answers
53 views

Hydra hangs after 16 attempts

When I try to brute-force my router's admin page, Hydra is never making more than 16 attempts. After 16 attacks I receive only status updates with less and less tries per minute. Beside that, all ...
1
vote
0answers
66 views

How to prevent DirBuster to stop listing apache server side files

I have deployed a php project on apache. When I use DirBuster tool to scan my site, it lists all server side files. I want to stop this listing. I have modified the permission. When I give the less ...
1
vote
0answers
40 views

DVWA hydra brute not matching

I am trying to brute force DVWA on low security. I disabled the first authentification as well. However when I ran my hydra script it doesn't match it with correct password. Here is my query hydra -l ...
1
vote
0answers
49 views

trapdoor information with hash functions

I have been playing with an idea for the past few days. I have been unable to find information on here or crypto.stackexchange about using trapdoor information in the input to a hash function. ...
1
vote
0answers
95 views

How secure is Asus router latest framework function: “Added protection mechanism for GUI login brute-force attack for login username and password.”?

I have just updated my RT-N12 D1 router to the latest framework, and it has new function - "Added protection mechanism for GUI login brute-force attack for login username and password.". I Googled and ...
1
vote
0answers
361 views

Storing Social Security Numbers in a Database

I'm developing an online application that needs the user's social security number. The application won't be processed on the web server so I'll be using an asymmetric key. So a compromised web server ...
1
vote
0answers
5k views

Linux Hydra issue - random correct password success

I have an issue with Hydra when I use it. I have tried the same command lines given in guides directly supported by the Damn Vulnerable Web Application (DVWA) v1.8. Ok so.. here is my attempt output....
0
votes
0answers
24 views

Cyrus-Imap (v2.3.16) local logon attack

CentOS-6.7 Cyrus-IMAP-2.3.16 The host inet07.hamilton.harte-lyne.ca is our IMAP server host. It offers imap and pop3 publicly. I uses local accounts (/etc/passwd) for imap/pop3 authentication only....
0
votes
0answers
36 views

What is a straightforward way to brute force CLI applications?

This is a question to maybe more CTF-experienced guys among you. I wonder how you generally brute force a simple CLI application. For example if you have an application which tells you a user's data ...
0
votes
0answers
109 views

Hydra command for cracking a webpage which uses <span> tag for failed login attempts

I'm trying to for crack a simple webform for testing hydra in Kali. When the webpage encounters a wrong username and password combination it pops up a message using the following html code:: <tr&...
0
votes
0answers
122 views

Would it take long to brute force a md5 hash like this?

1be8917510-36.51929856278002 10bce1af27-99.18403192423284 103fa11cc6-87.21158325206488 Few examples above and as you can see the pattern is: 1xxxxxxxxx-{a percentage (0-100) to 14 decimal places} ...
0
votes
0answers
1k views

Brute-Force/Dictionary attack against encypted file using PBKDF2 key derivation

I have been following this very useful post by Thomas. My use case is slightly different. I am developing a mobile application which requires some sensitive data to be stored on the device in a SQLite ...