The tag has no usage guidance.

learn more… | top users | synonyms

0
votes
0answers
18 views

Inserting XSRF header token in Hydra

I'm trying to break a login form with Hydra. The site is built with the Angular framework, and an XSRF token must be sent through the header and through the POST request. I notice that the XSRF ...
0
votes
2answers
118 views

Are password-guessing attacks a real threat?

There are tons of questions, answers, articles, papers, cartoons etc. on the subject of how to choose a password in such a way that it's difficult to guess or crack with a dictionary-based attack. I ...
1
vote
1answer
77 views

Is it secure to allow an account to use `test123!` as their password?

I'm working on tightening up security for the auth layer of my app and I'm currently making a call on the complexity I'll require for passwords. Is there a 'standard' recommendation for complexity? ...
5
votes
4answers
250 views

Password guessing: Is it more effective to try many passwords against a few accounts or a few (very common) passwords against many accounts?

I was watching a security vid on Irongeek the other day (I immediately lost track of which specific vid, unfortunately) where the creator gave some interesting advice about doing live password ...
4
votes
2answers
714 views

I tried to break my WiFi: is 8 uppercase letter strong enough?

My Wi-Fi WPA-PSK password looked pretty weak: 8 uppercase letter. I have checked with another router from the same provider and the pattern is the same. To see how weak this is I tried to hack it ...
2
votes
4answers
123 views

What is the risk of different responses when a login username matches or not?

I am responsible for a website that allows a user to reset the password, as usual. However, the response of the website is different whether the entered username matches or not. This would allow an ...
2
votes
0answers
74 views

Password cracking based on properties of target

Many people base their passwords on some characteristics or properties of their persona, which might not even be included in wordlists used for a dictionary attack. If one would put research into ...
-2
votes
1answer
63 views

generating “non-dictionary” numeric passcodes [closed]

In case of numeric passcodes, e.g. for numeric locks on doors etc, anyone can agree "poor passwords" are ones with specific pattern, e.g. 1234, 1111, 2468, 1122, etc. (as well as ones that form a ...
3
votes
2answers
227 views

How to generate a password dictionary for a specific use

I have a locked work file that I need access to. Unfortunately, the company that provided the file is no longer in existence and I can't track anyone down to help me out. The file is encrypted and ...
1
vote
0answers
259 views

Designing a dictionary attack using hydra on web login page [closed]

I am trying to develop a pentest on a product for a customer that is really interested in implementing good security. Using tamper data I get this information when clicking on the "Login" button in ...
0
votes
0answers
37 views

hydra password penetration test syntax [duplicate]

I am trying to penetrate a password on my own website using hydra. Let's say that I know login and password and i just put both there like in sample below: hydra -l admin -p password 123.123.123.123 ...
5
votes
4answers
14k views

Wifi penetration testing: Why aireplay-ng de-authentication does not work?

I am trying to pentest the security of the password of my wireless network. It is a WPA2 with pre-shared-keys. My current computer is connected to the wifi router and I try to de-auth my own machine. ...
4
votes
3answers
23k views

What are the differences between dictionary attack and brute force attack?

Can someone explain the major differences between a Brute force attack and a Dictionary attack. Does the term rainbow table has any relation with these?
4
votes
2answers
461 views

XKCD-like passphrases to stdout

I'm trying to find a way to crack XKCD-like passphrases (correcthorsebatterystaple) from word dictionaries. Basically concatenate X number of words from a dictionary file. Right now it honestly ...
-1
votes
1answer
327 views

Where can I find good word list for MySQL 5? [closed]

I wonder where can I find good collections of dictionaries which can be used for MySQL 5 dictionary attack? I just need MySQL 5 word lists / dictionaries. I found a lot of MD5, SHA1, etc. but not ...
1
vote
2answers
212 views

Password Cracking Mandarin Words English Character Set

I'll be looking to perform a domain password audit in which the user will be using english characters but may be 40% Mandarin speakers so I anticipate a large number of names, phrases, or words that ...
2
votes
2answers
450 views

Is it really “Time to add a word” if there are no tools to crack passphrases of 3 words and up?

It's "time to add a word" says Arnold Reinhold, the creator of Diceware, in his blog (3/2014). He advices to use 6 word sentences (or 5 words with one extra character chosen and placed at random) from ...
0
votes
2answers
231 views

Showing CAPTCHA

I'd like to show a CAPTCHA to prevent brute forcing attempts, but I was thinking of showing it whenever a user fails for an invalid username/password combination after X attempts, regardless of ...
1
vote
2answers
2k views

How do I generate a word list from a known seed word? [duplicate]

I've lost my master password. Not all is lost as I know the original word that generated the password: It was generated by a random case switching for consonants and random vocal to numbers. For ...
5
votes
1answer
2k views

Chinese or “pinyin” wordlists for dictionary attacks

Background: I am currently trying to crack a salted md5 hash which I have recovered from an embedded device running busybox and manufactured in china. I have tried john the ripper using all of the ...
4
votes
3answers
349 views

Could using a generated key from an online service be considered a risk?

With some colleagues we're having a debate regarding the randomkeygen.com website. I do think that there is a security risk using the generated keys of this (or any of this kind) website. Why ? ...
-1
votes
2answers
48 views

What kind of dictionaries can be created from a normal dictionary? [closed]

We have many text files with ~all the words from a given language. Does someone know a "full" list of methods a word/dictionary can be remaked? ex.: testword can be converted using leetspeak ...
1
vote
3answers
646 views

Is applying AES multiple times safer?

The KeePass security help page talks about preventing dictionary attacks To generate the final 256-bit key that is used for the block cipher, KeePass first hashes the user's password using ...
9
votes
4answers
125k views

Wordlists on Kali Linux?

I notice that in /usr/share/wordlists in Kali Linux (former Backtrack) there are some lists. Are they used to bruteforce something? Is there specific list for specific kind of attacks?
5
votes
6answers
14k views

How can I generate custom brute-force dictionaries?

I have found during testing that companies often use variations of their names for critical passwords (for example Microsoft's password might be M1cr0s0f+ or m1cros0ft etc etc). So if I gave it the ...
15
votes
5answers
69k views

How to generate dictionary for a dictionary attack?

I need to crack my own password. Advantage is that I know possible characters and maximum length. What I need is to create a dictionary. The dictionary should contain all the combos of characters ...
-2
votes
1answer
1k views

LophtCrack version 6.0.12 is not auditing my Administrator password [closed]

I am using LophtCrack on my Windows 8 OS. I was testing my password strength and the problem I am seeing it is not working. It doesn't reveal my Admin password, I've run the process for half an hour. ...
7
votes
3answers
1k views

Password list generation

I've found during a lot of recent pen-tests that companies will use passwords like c0mp4ny@b( for a company called "company abc" Is there any quick and easy way to generate a list of passwords ...
94
votes
9answers
185k views

Where can I find good dictionaries for dictionary attacks?

I’m wondering where I can find good collections of dictionaries which can be used for dictionary attacks? I've found some through Google, but I’m interested in hearing about where you get your ...