Questions tagged [brute-force]
An attack using every possible input to attempt to produce the correct output. Typically the method of last resort when no weakness allows the use of a more restricted input set. E.g. trying all possible (or likely) passwords, in an attempt to guess the correct one.
790
questions
139
votes
9
answers
339k
views
Where can I find good dictionaries for dictionary attacks?
I’m wondering where I can find good collections of dictionaries which can be used for dictionary attacks?
I've found some through Google, but I’m interested in hearing about where you get your ...
- 16.2k
126
votes
10
answers
18k
views
How critical is it to keep your password length secret?
Is keeping your password length secret critical to security?
Does someone knowing that you have a password length of say 17 make the password drastically easier to brute force?
- 2,617
101
votes
5
answers
32k
views
Someone is trying to brute-force(?) my private mail server... very... slowly... and with changing IPs
This has been going on for about 1-2 days now:
heinzi@guybrush:~$ less /var/log/mail.log | grep '^Nov 27 .* postfix/submission.* warning'
[...]
Nov 27 03:36:16 guybrush postfix/submission/smtpd[7523]:...
- 3,088
93
votes
8
answers
17k
views
Can secret GET requests be brute forced? [duplicate]
Say, I have on my server a page or folder which I want to be secret.
example.com/fdsafdsafdsfdsfdsafdrewrew.html
or
example.com/fdsafdsafdsfdsfdsafdrewrewaa34532543432/admin/index.html
If the ...
- 921
92
votes
6
answers
14k
views
Script Kiddies - how do they find my server IP?
I've set up a site on Digital Ocean without a domain yet, so there is only the IP.
Despite telling no-one of its existence or advertising it, I get hundreds of notices from fail2ban that various IP's ...
- 2,473
91
votes
9
answers
19k
views
Is it possible make brute-force attacks ineffective by giving false positive answers to failed log-in attempts?
I don't have any experience or scientific knowledge in security, I just wanted to ask if this is possible because I am interested in it.
What if I encrypt data and every password decrypts it, but ...
- 881
71
votes
3
answers
127k
views
How to estimate the time needed to crack RSA encryption?
How to estimate the time needed to crack RSA encryption? I mean the time needed to crack Rsa encryption with key length of 1024, 2048, 3072, 4096, 5120, 6144, 5120, 7168, 8192, 9216, 10240, 11264, ...
- 961
67
votes
8
answers
28k
views
Am I experiencing a brute force attack?
When checking the auth log of a server with the command:
grep sshd.\*Failed /var/log/auth.log | less
I see thousands of lines like this:
Jan 12 11:27:10 ubuntu-leno1 sshd[8423]: Failed password ...
- 761
67
votes
4
answers
16k
views
How did the brute-forcers get my IP address so quickly?
This is probably a massive noob question, but Google results aren’t being helpful and I couldn’t find something specific here.
I made this server that just hosts IRC, HTTP and SSH for some friends. I ...
- 691
60
votes
6
answers
16k
views
Wrong password - number of retries - what's a good number to allow?
Most sites & software seem to have a default of auto lock or time lock after 3 wrong tries.
I feel that the number could be much higher - not allowing retries is mainly to prevent automated ...
- 2,032
56
votes
7
answers
72k
views
Invalid users trying to log in to my server
I'm seeing a lot of log entries that appear to be failed login attempts from unknown IP addresses.
I am using private and public keys to log in with SSH but I have noticed that even with private ...
- 671
53
votes
7
answers
38k
views
How are GPUs used in brute force attacks?
I have read that GPUs can be used in brute force attacks? But how can this be done and is there a need for any other hardware devices (hard disks for instance)?
Note: I'm more interested in web ...
52
votes
4
answers
52k
views
Are salted SHA-256/512 hashes still safe if the hashes and their salts are exposed?
Scenario: a database of hashed and and salted passwords, including salts for each password, is stolen by a malicious user. Passwords are 6-10 chars long and chosen by non-technical users.
Can this ...
- 621
43
votes
9
answers
9k
views
Do non-keyboard characters make my password less susceptible to brute forcing?
I can put characters in my password for which there are no keys on a keyboard. On Windows, Alt+#### (with the numpad) inserts the character for whatever code you type in.
When I put this in a ...
- 1,782
42
votes
1
answer
19k
views
How does the attacker know what algorithm and salt to use in a dictionary attack?
I am curious about password cracking methods like dictionary and brute force attacks. Nowadays passwords are stored as hashes and not plaintext on the server. Then how can the plaintext passwords in ...
- 598
42
votes
3
answers
11k
views
Should Failed Login Attempts Be Logged
Should failed login attempts be logged? My doubt is that if there is a distributed brute force attack, it might exhaust the available disk space of the database. What is the best practice for this?
I'...
- 741
39
votes
8
answers
6k
views
Find matching phone numbers without actually knowing them
We have a mobile app that, given two users, needs to let them see what common contacts they have based on their phone numbers. How can we do this in a cryptographically secure way and respecting the ...
- 493
38
votes
8
answers
17k
views
Is brute force a probable threat even if you enable CAPTCHA and rate limit logins?
Let's assume CAPTCHA is enabled with account lock out control (after five continuous failed attempts, the account will be locked for 15 min) on a system.
Is brute force still a probable threat?
- 2,031
37
votes
2
answers
9k
views
When could 256 bit encryption be brute forced?
Assuming quantum computing continues to improve and continues to perform like this:
... quantum computer completes 2.5-billion-year task in minutes
is it reasonable to expect that 256 bit encryption ...
- 1,280
36
votes
7
answers
9k
views
Is it possible to improve brute-force guessing of a password with a picture of the keyboard used to enter it?
Is it a bad idea to post a photo of your keyboard to social media?
Can I look at a photo of a keyboard and determine the password of an account?
Assuming a certain (set of) password(s) is the most ...
- 515
35
votes
7
answers
7k
views
How to know if a file is decrypted or not
For school, I have to do an exercise in which I have to decrypt files by brute force attack.
There are a lot of different files in different file formats. The files have been encrypted using XOR or ...
- 461
35
votes
2
answers
43k
views
Why are GPUs so good at cracking passwords?
What is it about GPUs that lets them crack passwords so quickly?
It seems like the driving force behind adopting good key-derivation functions for passwords (bcrpyt, PBKDF2, scrypt) instead of ...
- 455
34
votes
5
answers
7k
views
Does it matter if a brute force search for a password returns a collision and not the password?
Assume the following very basic hashing algorithm.
h(k) = k mod 17
Let's say we create a password 12345 for a website that uses this very basic hashing algorithm. That would yield the hash of 3.
...
- 2,361
34
votes
2
answers
50k
views
What's the purpose? Strange login attemps "sshd[***] Received disconnect from **.**.**.**: 11: Bye Bye [preauth]"
I've seen something like:
sshd[***]: Invalid user oracle from **.**.**.** // 1st line
sshd[***]: input_userauth_request: invalid user oracle [preauth] // 2nd line
...
- 443
32
votes
12
answers
15k
views
Could I recover the content of file from its checksum/hash?
Let's say I have a video file that is split into multiple parts. Each piece is 2 Megabytes. I also have a list of the *insert hash name here* for each piece and also for the full file.
Now assume ...
- 565
32
votes
5
answers
8k
views
SSH - If Eve has the passphrase and public key, can she derive the private key?
I have used ssh-keygen for creating an RSA 4096-bit SSH private and public key pair. I used a passphrase for the private key.
If an attacker, Eve, knows the passphrase in addition to the public key:
...
- 423
31
votes
5
answers
23k
views
How unlikely is it that a Google Doc link is guessed?
Most (if not all) of us know that a Google Doc link looks something like this:
https://docs.google.com/document/d/13P3p5bA3lslqEJT1BGeTL1L5ZrQq_fSov_56jT9vf0I/edit
There are becoming several tools (...
- 1,795
30
votes
5
answers
3k
views
What are the security implications of storing password blacklist?
I want to add a password blacklist that would prevent the 1000 most common passwords from being used in order to mitigate shallow dictionary attacks. Is there any negative implication of storing this ...
- 553
28
votes
3
answers
7k
views
Use multiple computers for faster brute force [duplicate]
I've watched Mr. Robot lately and can't stop thinking why it was so hard to decrypt files encrypted using AES encryption with a 256-bit key.
Let us say the only method to find the key is through brute ...
- 845
28
votes
6
answers
175k
views
Is it possible to brute force all 8 character passwords in an offline attack?
This article states:
Brute-force techniques trying every possible combination of letters, numbers, and special characters had also succeeded at cracking all passwords of eight or fewer characters.
...
28
votes
3
answers
85k
views
Why does Hydra return 16 valid passwords when none are valid?
I've been playing around with Hydra and DVWA and I've hit a bit of a snag - Hydra responds letting me know that the first 16 passwords in my password list are correct when none of them are.
I assume ...
- 9,237
27
votes
4
answers
11k
views
Should I implement incorrect password delay in a website or a webservice?
With arguments expressed in this answer, there is a few seconds delay between user enters an incorrect password and when he/she actually learns, that password was incorrect. This security solution is ...
- 3,629
27
votes
4
answers
28k
views
how long does it take to actually generate rainbow tables?
I've been reading up about rainbow tables as I think they're quite interesting cause they're actually a pretty simple concept.
Anyway, I was wondering, has anyone been involved in actually generating ...
- 1,590
27
votes
3
answers
15k
views
Rate limit login attempts: count by IP or username
I need to limit login attempts.
One option is to count attempts by IP address and then block the IP. The disadvantage is that different users may have the same IP address. Another option is to limit ...
- 393
27
votes
11
answers
12k
views
Best password strength checker
In XKCD #936: Short complex password, or long dictionary passphrase? Jeff claimed that password cracking with "dictionary words separated by spaces", or "a complete sentence with punctuation", or "...
- 2,789
26
votes
4
answers
11k
views
How practical is it to bruteforce a 10-digit number via URL
Example URL www.[somewebsite].com/[10_digit_number]
Getting the correct number loads a page.
I know there would be 10 billion possible digits to choose from, but how long would it take? What are the ...
- 289
26
votes
5
answers
12k
views
What's the practical limit for rainbow-table based bruteforce?
Say we have a hash of a password. The password can be considered to be made of of totally random characters and has a fixed length of N. The hash is SHA1(password+salt), where the salt is of length M. ...
- 866
26
votes
5
answers
2k
views
What concrete parameters can I change to make my passphrase-protected private gpg key more secure
There are several questions which discuss the resistance of passphrase-protected private gpg keys against brute force attacks. It seems, this kind of discussion could go on forever.
Rather than ...
- 1,721
25
votes
6
answers
9k
views
What would be the key size for a picture used as a key?
I'm working on a cryptosystem that uses colour pictures as keys for encryption. I'm trying to guess what is the key size of my cryptosystem in order to find the feasibility of a brute force attack. My ...
25
votes
8
answers
7k
views
How to respond to a SSH brute force attack on a single VPS?
I logged onto my VPS this morning to find millions of failed login attempts for the root user and other users that don't even exist. I took the below measures to try and obfuscate the attackers ...
- 353
25
votes
3
answers
15k
views
Is this what a brute force SSH attack looks like?
I reviewed the auth.log file on my Ubuntu server to find:
[preauth]
Feb 22 17:39:18 code-storage sshd[17271]: Disconnected from 147.135.192.203 port 49408 [preauth]
Feb 22 17:40:15 code-storage sshd[...
- 456
24
votes
7
answers
11k
views
After a password leak, is there a Levenshtein distance from which one a newly derivated password can be considered safe?
After a password leak, is there a Levenshtein distance from which one a newly derivated password can be considered safe?
I assume yes, given that if e.g. the word was "password", and the new ...
- 452
24
votes
7
answers
18k
views
Are reCAPTCHA enough to prevent brute-force password guesses?
I was wondering if reCAPTCHA were strong enough to prevent BruteForce from bots or if I needed to add more security, such as sending a unique mail to the user every 5 tries that someone try to log on ...
- 419
24
votes
2
answers
55k
views
Brute Forcing Password to a Truecrypt-encrypted file with Partial Knowledge
A while back, I encrypted a few files with Truecrypt, and stored the password in my head. Now I need to access it again, the password isn't working. I'm sure most of it is right, but I'm off by one or ...
- 241
24
votes
4
answers
11k
views
Protection against account lockout DoS
Any ideas on how to protect against the following scenario?
Company x uses active directory for authentication of it's employees. The company has multiple authentication points that are semi-public ...
- 1,387
23
votes
2
answers
19k
views
Do Veracrypt encrypted volumes have any kind of brute force protection?
I have a 10mb encrypted volume which I made with Veracrypt and was planning to upload it to the internet. I have a pretty strong password but was worried about its protection against brute force ...
- 569
22
votes
4
answers
9k
views
Does password length / complexity make any difference if hashes are leaked?
Password length/complexity only mitigates a brute force attack, correct? In the event of a hash leak, since any algorithm is a fixed length, there could potentially be a pre-image* with a very short / ...
- 323
22
votes
5
answers
119k
views
How to generate dictionary for a dictionary attack?
I need to crack my own password. Advantage is that I know possible characters and maximum length.
What I need is to create a dictionary. The dictionary should contain all the combos of characters ...
- 323
22
votes
3
answers
21k
views
How is Gmail susceptible to brute-force attacks?
In the Atlantic article "Hacked!" it says:
My wife’s password was judged as “strong” when she first chose it for use with Gmail. But it was a combination of two short English words followed by ...
- 349
22
votes
1
answer
8k
views
Timing attacks on password hashes
Timing attacks can have a devastating impact in scenarios where the secret is involved, often in cases where byte-wise array comparison is used.
Now there are those that advertise using constant ...
- 4,348