0
votes
1answer
33 views

Do dictionary attacks only use specific entries from a dictionary, or combinations of an entry?

If I wanted to crack a password, "cba", but the dictionary I was using only had abc in it, does a dictionary attack try all combinations of abc? abc, acb, bca, bac, cba, cab Or would cba have to be ...
7
votes
1answer
265 views

How to stop password recovery attempts on accounts?

I am using social networking services such as My Banking GMail PayPal Facebook Twitter Google+ LinkedIn All of these services text messages me a six digit code to login from anywhere, even a ...
1
vote
2answers
118 views

Forced to use using 2-Step Authentication to keep online profiles safe?

I am starting to see a majority of services, websites, and social networks offering the 2-step Authentication like crazy now to protect their users. Also, after reading how the Twitter Account N was ...
1
vote
1answer
119 views

How does an attacker authenticate to a service using just the hash of the user (after performing a pth attack)

Let's say the attacker got the username and the password's hash. How can he use it when authenticating to some service in its domain with NTLM , for example? How can he send the request as the ...
-1
votes
1answer
1k views

Hydra bruteforce is giving wrong passwords. Can't seem to work any help? [closed]

Ok so what im actually trying to do is to bruteforce my own account on some website just to check myself . This is NOT for illegal steps or use , im trying to crack my OWN password , and im trying to ...
-1
votes
2answers
118 views

I don't understand how BIPS got hacked [closed]

http://www.networkworld.com/news/2013/112513-bitcoin-robbery-276352.html In this story we can see BIPS got hacked, but I don't get how it was hacked when it was offline because of the DDoS.
8
votes
2answers
466 views

Plain Text Password Reset Vulnerability

If I receive an email with a plain text generated password (in response to a password reset request), is this a vulnerability? The password expires after one use, in other words the user has to change ...
6
votes
2answers
316 views

Password list generation

I've found during a lot of recent pen-tests that companies will use passwords like c0mp4ny@b( for a company called "company abc" Is there any quick and easy way to generate a list of passwords ...
13
votes
2answers
351 views

Concrete figures on password cracking in the wild

While password guessing is a science, not every attacker out there is up-to-date with the latest advances or cares to invest in GPUs or FPGAs. It's easy enough to test online password guessing ...
0
votes
1answer
197 views

What type of attack should be used in order to pass this authentication

I am practicing the Astalavista Wargames and i came across this challenge. The question is: Bob wrote a piece of software but the password verification doesn't seem to work. You must find a way to log ...
3
votes
4answers
527 views

Can public keys be a security risk when performing password-less SSH logins?

Some companies use monitoring software such as nagios or icinga. In order to perform checks on the servers, they often need password-less SSH logins. The servers being checked put the public key of ...
18
votes
7answers
813 views

Are common passwords at particular risk?

The question Should we disallow common passwords like “password” and “12345”? on User Experience immediately made me think that these common passwords were extremely dangerous not because they are ...
19
votes
4answers
3k views

Why is using salt more secure?

Storing the hash of users' passwords, e.g. in a database, is insecure since human passwords are vulnerable to dictionary attacks. Everyone suggests that this is mitigated via the use of salts, but the ...
2
votes
2answers
180 views

What are stolen passwords used for?

Say there is a line of business application which has username/password datatable in the DB. Personal email address is not stored, and usernames are assigned by an administrator. Someone gains access ...
8
votes
5answers
2k views

How to catch a gmail hacker/money-scammer? (in conversation with one right now!)

My friend's GMail account was recently hacked and the perpetrator sent out one of those classic "help I was mugged, I need money" style e-mails. (Edit: I know it's legit; my friend called me to tell ...
6
votes
3answers
798 views

Attack vectors for brute-forcing website passwords

When talking about password security, a lot of discussion centers on the risk of a password being guessed in a brute-force attack. For websites where a user has registered an account, what are the ...
5
votes
5answers
2k views

What password cracking software is commonly used?

I am curious to know how secure my passwords are. What password cracking software is commonly used? Preferably open source. EDIT: I am actually looking to crack my passwords used on services I ...
7
votes
6answers
1k views

Facebook account keeps getting hacked, can't seem to figure out why or how?

One of my mate, she has a lot of friends on Facebook, uses it for marketing. Her account keeps getting broken into. Her password gets reset and/or gets locked for changing resetting password too many ...
18
votes
4answers
4k views

Security of passphrase-protected private key

If an attacker obtains a private key that was created with no passphrase, he obviously gains access to everything protected with that key. How secure are private keys set up with a passphrase? If an ...
50
votes
8answers
78k views

Where can I find good dictionaries for dictionary attacks?

I’m wondering where I can find good collections of dictionaries which can be used for dictionary attacks? I've found some through Google, but I’m interested in hearing about where you get your ...
5
votes
8answers
2k views

Retrieving OSx Keychain passwords

I have a computer forensics style osx login.keychain file that I am trying to find the passwords from. I have a very weak mac which I used crowbarkc on to try and brute force but the horsepower is ...