An attack using every possible input to attempt to produce the correct output. Typically the method of last resort when no weakness allows the use of a more restricted input set. E.g. trying all possible (or likely) passwords, in an attempt to guess the correct one.

learn more… | top users | synonyms

95
votes
11answers
13k views

How critical is it to keep your password length secret?

Is keeping your password length secret critical to security? Does someone knowing that you have a password length of say 17 make the password drastically easier to brute force?
94
votes
9answers
184k views

Where can I find good dictionaries for dictionary attacks?

I’m wondering where I can find good collections of dictionaries which can be used for dictionary attacks? I've found some through Google, but I’m interested in hearing about where you get your ...
81
votes
6answers
11k views

Script Kiddies - how do they find my server IP?

I've set up a site on Digital Ocean without a domain yet, so there is only the IP. Despite telling no-one of its existence or advertising it, I get hundreds of notices from fail2ban that various IP's ...
55
votes
8answers
9k views

Am I experiencing a brute force attack?

When checking the auth log of a server with the command: grep sshd.\*Failed /var/log/auth.log | less I see thousands of lines like this: Jan 12 11:27:10 ubuntu-leno1 sshd[8423]: Failed ...
46
votes
7answers
9k views

How are GPUs used in brute force attacks?

I have read that GPUs can be used in brute force attacks? But how can this be done and is there a need for any other hardware devices (hard disks for instance)? Note: I'm more interested in web ...
45
votes
4answers
65k views

How to estimate the time needed to crack RSA encryption?

How to estimate the time needed to crack RSA encryption? I mean the time needed to crack Rsa encryption with key length of 1024, 2048, 3072, 4096, 5120, 6144, 5120, 7168, 8192, 9216, 10240, 11264, ...
42
votes
4answers
30k views

Are salted SHA-256/512 hashes still safe if the hashes and their salts are exposed?

Scenario: a database of hashed and and salted passwords, including salts for each password, is stolen by a malicious user. Passwords are 6-10 chars long and chosen by non-technical users. Can this ...
32
votes
7answers
3k views

How to know if a file is decrypted or not

For school, I have to do an exercise in which I have to decrypt files by brute force attack. There are a lot of different files in different file formats. The files have been encrypted using XOR or ...
32
votes
7answers
30k views

Invalid users trying to log in to my server

I'm seeing a lot of log entries that appear to be failed login attempts from unknown IP addresses. I am using private and public keys to log in with SSH but I have noticed that even with private ...
31
votes
8answers
5k views

Do non-keyboard characters make my password less susceptible to brute forcing?

I can put characters in my password for which there are no keys on a keyboard. On Windows, Alt+#### (with the numpad) inserts the character for whatever code you type in. When I put this in a ...
30
votes
5answers
2k views

What are the security implications of storing password blacklist?

I want to add a password blacklist that would prevent the 1000 most common passwords from being used in order to mitigate shallow dictionary attacks. Is there any negative implication of storing this ...
27
votes
10answers
5k views

Could I recover the content of file from its checksum/hash?

Let's say I have a video file that is split into multiple parts. Each piece is 2 Megabytes. I also have a list of the *insert hash name here* for each piece and also for the full file. Now assume ...
26
votes
3answers
4k views

Use multiple computers for faster brute force [duplicate]

I've watched Mr. Robot lately and can't stop thinking why it was so hard to decrypt files encrypted using AES encryption with a 256-bit key. Let us say the only method to find the key is through brute ...
26
votes
2answers
20k views

Why are GPUs so good at cracking passwords?

What is it about GPUs that lets them crack passwords so quickly? It seems like the driving force behind adopting good key-derivation functions for passwords (bcrpyt, PBKDF2, scrypt) instead of ...
25
votes
10answers
6k views

Best password strength checker

In XKCD #936: Short complex password, or long dictionary passphrase? Jeff claimed that password cracking with "dictionary words separated by spaces", or "a complete sentence with punctuation", or ...
23
votes
4answers
15k views

how long does it take to actually generate rainbow tables?

I've been reading up about rainbow tables as I think they're quite interesting cause they're actually a pretty simple concept. Anyway, I was wondering, has anyone been involved in actually generating ...
21
votes
5answers
6k views

What's the practical limit for rainbow-table based bruteforce?

Say we have a hash of a password. The password can be considered to be made of of totally random characters and has a fixed length of N. The hash is SHA1(password+salt), where the salt is of length M. ...
21
votes
1answer
3k views

Timing attacks on password hashes

Timing attacks can have a devastating impact in scenarios where the secret is involved, often in cases where byte-wise array comparison is used. Now there are those that advertise using constant ...
20
votes
4answers
5k views

Would allowing shorter passwords sometimes be more secure?

Does the act of requiring certain criteria for passwords make them easier to brute-force? It's always seemed to me that when websites limit the use of "insecure" passwords, it might make it easier ...
20
votes
4answers
8k views

How is Gmail susceptible to brute-force attacks?

In the Atlantic article "Hacked!" it says: My wife’s password was judged as “strong” when she first chose it for use with Gmail. But it was a combination of two short English words followed by ...
20
votes
7answers
3k views

Are reCAPTCHA enough to prevent brute-force password guesses?

I was wondering if reCAPTCHA were strong enough to prevent BruteForce from bots or if I needed to add more security, such as sending a unique mail to the user every 5 tries that someone try to log on ...
19
votes
3answers
2k views

Rate limit login attempts: count by IP or username

I need to limit login attempts. One option is to count attempts by IP address and then block the IP. The disadvantage is that different users may have the same IP address. Another option is to limit ...
19
votes
4answers
5k views

Protection against account lockout DoS

Any ideas on how to protect against the following scenario? Company x uses active directory for authentication of it's employees. The company has multiple authentication points that are semi-public ...
18
votes
4answers
4k views

Should I implement incorrect password delay in a website or a webservice?

With arguments expressed in this answer, there is a few seconds delay between user enters an incorrect password and when he/she actually learns, that password was incorrect. This security solution is ...
18
votes
7answers
936 views

Are common passwords at particular risk?

The question Should we disallow common passwords like “password” and “12345”? on User Experience immediately made me think that these common passwords were extremely dangerous not because they are ...
18
votes
2answers
25k views

Brute Forcing Password to a Truecrypt-encrypted file with Partial Knowledge

A while back, I encrypted a few files with Truecrypt, and stored the password in my head. Now I need to access it again, the password isn't working. I'm sure most of it is right, but I'm off by one or ...
18
votes
2answers
17k views

What's the purpose? Strange login attemps “sshd[***] Received disconnect from **.**.**.**: 11: Bye Bye [preauth]”

I've seen something like: sshd[***]: Invalid user oracle from **.**.**.** // 1st line sshd[***]: input_userauth_request: invalid user oracle [preauth] // 2nd line ...
18
votes
5answers
672 views

What concrete parameters can I change to make my passphrase-protected private gpg key more secure

There are several questions which discuss the resistance of passphrase-protected private gpg keys against brute force attacks. It seems, this kind of discussion could go on forever. Rather than ...
17
votes
6answers
2k views

Is there a brute-force attack similar to what they demonstrate in movies [duplicate]

Since I was a teenager (that's 20 years ago) and till now-days you see movies with professionals stealing a super-computer and use it to crack a password or a home security system using brute-force (I ...
16
votes
8answers
1k views

Bruteforce vs Denial of Service

I had a problem presented today which I found quite interesting. You have an application with a management panel. You know some of the accounts as they are standard. You want two things: You want ...
16
votes
5answers
3k views

What is the difference between login throttling and temporary account lockout?

I am currently working on the redesign of a login page. I have initially suggested that login be throttled whereby pauses (incremental - in number of seconds) are introduced between each failed login ...
16
votes
3answers
2k views

Why check to see if a password is already used by another user?

This is coming from a joke originally in French: Enter your password. carrot Sorry, your password must be more than 8 characters. carottegéante (giant carrot) Sorry, your ...
15
votes
5answers
69k views

How to generate dictionary for a dictionary attack?

I need to crack my own password. Advantage is that I know possible characters and maximum length. What I need is to create a dictionary. The dictionary should contain all the combos of characters ...
15
votes
4answers
2k views

Attract Brute Force SSH Attacks

I posted a question on Server Fault, but got downvoted and had the question closed. One of the comments suggested looking over here, so here goes: For my senior project, I'm working on an ...
15
votes
2answers
1k views

Are there some good papers (or discussions) on using Markov chains or Hidden Markov Models for password auditing/cracking?

As a programmer and language enthusiast I've been very interested in Markov chains for some time. Considering the influence of natural language on password and passphrase selection (by humans of ...
14
votes
3answers
4k views

Bruteforce attack on my FTP server

I recently setup VSFTPD on my personal server for sharing files over FTP. In the vsftpd.log file, i see hundreds of failed attempts to login with usernames like "adminitrator" , "adminitrator1", ...
14
votes
3answers
20k views

Why does Hydra return 16 valid passwords when none are valid?

I've been playing around with Hydra and DVWA and I've hit a bit of a snag - Hydra responds letting me know that the first 16 passwords in my password list are correct when none of them are. I assume ...
14
votes
3answers
9k views

Cracking MS-CACHE v2 hashes using GPU

As most people here will know, Windows caches domain/AD credentials in a format known as MS-Cache v2. Obviously, these would be excellent passwords to gain during a penetration test when local access ...
12
votes
1answer
754 views

General purpose slow/unique hash routine for dup checking of private data, without storing the data itself?

I am wondering if there is a percentage of uniqueness known to be lost with every repeat of various hash routines, like MD5, SHA1, and how that might compare with other algorithms. If theoretically I ...
12
votes
4answers
744 views

How should I secure a contact form that appears on every page of a website?

My client has a small "Contact Us" form on every page of their website. They are adamant about not including CAPTCHA verification on these forms, to keep them easy to use, but I feel it is my ...
12
votes
1answer
572 views

What's an attack's 'computational complexity'?

I'm writing a business-language report about MD5. In my search a found a paper by Yu Sasaki and Kazumaro Aoki explaining their 2123.4 pre-image attack on MD5. I know that it has something to do with ...
12
votes
2answers
768 views

Zip file with two password

I used this command to password protect a zip file on Linux : zip -P 9000 hash.zip hash.py and it creates the zip file just fine, then I wrote a program to test every possible password on it from 1 ...
11
votes
8answers
4k views

With which algorithm I can prevent a brute force on a login?

I want make my software more secure. I want prevent it from brute force attack. I know that a strong password is the best but I can not control it. The algorithm must scale from a very small system ...
11
votes
2answers
382 views

How much security is compromised if we accept other characters as login (other than the original password)?

I've just realised that facebook accepts 3 forms of a password: Source: Facebook actually accepts three forms of your password: Your original password. Your original password with the ...
10
votes
4answers
7k views

In light of the FREAK TLS vulnerability, why do so many servers still offer RSA-EXPORT keys?

Ars Technica is reporting on a new attack against HTTPS. Called FREAK, the devices reported as vulnerable include iPhones, Android devices, and Macs running OS X. The attack (as has been clarified ...
10
votes
4answers
407 views

What are the drawbacks of login request throttling?

In a web application, one way to protect against password guessing attacks is to lock out accounts after a set number of failed logins. This could be done on both source IP address and username. For ...
9
votes
4answers
124k views

Wordlists on Kali Linux?

I notice that in /usr/share/wordlists in Kali Linux (former Backtrack) there are some lists. Are they used to bruteforce something? Is there specific list for specific kind of attacks?
9
votes
4answers
632 views

Are there state-of-the-art techniques or theory specifically for attacking passphrases over passwords?

With passphrases becoming more and more common based on length being more important than complexity, I'm assuming there must be some work going on involving techniques aimed specifically at cracking / ...
9
votes
3answers
2k views

Wordpress Brute Force Attacker knows real admin Username -

I've noticed a brute force attempt on several different Wordpress installs that know the right admin user name for those respective sites... It seems very strange that the hacker would be able to ...
9
votes
2answers
6k views

Why limit passwords to ascii printable characters? [duplicate]

Possible Duplicate: Do non-keyboard characters make my password less susceptible to brute forcing? Every article on password security that I read tells people to make the password more ...