0
votes
3answers
59 views

User Account Guessing

I'm doing some research on user account guessing, and wanted to ask a question about some "bad practices". My thought is generally this is a trade-off between great user functionality/UX and ...
0
votes
1answer
82 views

Cracking a 6-character alphanumeric password Windows dialog box

To put this problem in context, I have a touch monitor screen whose firmware program is protected by a password. The firmware program is downloaded over RS232 via a Windows utility program provided ...
2
votes
4answers
132 views

Does it take longer to brute force a password starting with z than one starting with a?

I was wondering about the following: If someone tries to get my password with Brute Force, will a password starting with "a" guessed faster than one starting with "z" ? In this case assume the ...
-4
votes
0answers
34 views

How to set a hydra http-post-form attack for this router login site? [on hold]

I'm trying to use hydra to crack it's password but don't know how to set a http-post-form attack! It's a router login websiteit which has 8088 port open.Can't do a ssh, ftp, or http-get,only ...
1
vote
2answers
156 views

In what situations can a hacker try to break passwords millions of times? [duplicate]

I keep reading about situations where a hacker could "easily" brute force a password (most recent example) but I'm confused about when some has an opportunity to do this kind of thing. If it is a ...
1
vote
1answer
132 views

Cracking MD5 passwords with the same salt

How long would it take to crack passwords up to 10 letters long if you knew the hashes were MD5 with a salt (that you know)?
1
vote
2answers
64 views

Are repeating random patterns weaker than non repeating random patterns?

Which would be harder to crack: a password comprising of n characters randomly selected or a password comprising of x randomly selected characters repeated m times so that m*x=n. For example: ...
3
votes
4answers
183 views

Ethical brute force demo on a web login when knowing the password complexity requirements

We are currently having accounts compromised at a substantially high rate. Some in the organization believe that our password complexity requirements is enough to thwart brute force attacks. I wanted ...
1
vote
3answers
105 views

Touch tone phone username and password

I just got off the phone with Fidelity, who manage the health benefits for the company where I work. Before talking to a person, I was prompted to enter my username and password on the numeric keypad: ...
2
votes
1answer
233 views

Hydra bruteforce and JSON

I am having problems with Hydra and a JSON payload. The login request (intercepted with Fiddler), is the following: POST http://architectureservice.test.com/api/v1/login HTTP/1.1 Host: ...
0
votes
0answers
204 views

Brute-Force/Dictionary attack against encypted file using PBKDF2 key derivation

I have been following this very useful post by Thomas. My use case is slightly different. I am developing a mobile application which requires some sensitive data to be stored on the device in a SQLite ...
1
vote
1answer
89 views

Is there an equation to calculate the number of instances of a series of characters exist in a given key space?

If I'm using 16-18 character-length passwords with 94 different possible values-per-character (lower alphas, upper alphas, numbers, and special characters), is there an equation I can use to calculate ...
-3
votes
1answer
44 views

How many possible symbols and punctuations in a password? [closed]

I want to compute the possible combinations of a password consists of 8 digits of: alphabetical letters (26), numbers (0-9), symbols and punctuations. In order to compute this, I have to know the ...
2
votes
1answer
103 views

Given a hash, salt, charset and password length, how do you get the password without brute-forcing it?

I got that question on an exercise and I'm not sure what to answer. Without conventional brute-forcing and without a rainbow table, how could I find out the password? An improved brute-force ...
0
votes
2answers
78 views

How do you overcome the problem of the salt being public and known by the attacker? [duplicate]

I believe that when adding a salt to the password you need to store the values so you can compute the hash again. But, what does happen if the attacker get the salt? How is it possible to add value ...
3
votes
3answers
242 views

Could using a generated key from an online service be considered a risk?

With some colleagues we're having a debate regarding the randomkeygen.com website. I do think that there is a security risk using the generated keys of this (or any of this kind) website. Why ? ...
0
votes
1answer
73 views

What is the best way to generate a password/pin like string using brute force method? [closed]

I have a string of 7 characters. I'm supposed to generate all the combinations. But some combinations are more likely than others, I would like the more likely ones to be generated first. If I ...
-1
votes
1answer
1k views

Hydra bruteforce is giving wrong passwords. Can't seem to work any help? [closed]

Ok so what im actually trying to do is to bruteforce my own account on some website just to check myself . This is NOT for illegal steps or use , im trying to crack my OWN password , and im trying to ...
4
votes
4answers
407 views

Can't brute force password cracking somehow be throttled?

Online articles mention the importance of a strong password and suggest that hacking tools allows bad guys to attempt millions of passwords per second. I am wondering why OSes and websites and such ...
1
vote
3answers
24k views

Wordlists on Kali Linux?

I notice that in /usr/share/wordlists in Kali Linux (former Backtrack) there are some lists. Are they used to bruteforce something? Is there specific list for specific kind of attacks?
2
votes
2answers
4k views

Is it possible to brute force all 8 character passwords in an offline attack?

This article states: Brute-force techniques trying every possible combination of letters, numbers, and special characters had also succeeded at cracking all passwords of eight or fewer characters. ...
2
votes
4answers
15k views

How to generete dictionary for brute force attack?

I need to crack my own password. Advantage is that I know possible characters and maximum length. What I need is to create dictionary for brute force attack. Dictionary should contain all the combos ...
2
votes
2answers
142 views

Slowing down repeated password attacks

I've been reading suggestions to use time-consuming formulas for checking passwords from login attempts, so that repeated attacks will be slowed down. Wouldn't it suffice to just sleep a bit in the ...
29
votes
5answers
2k views

What are the security implications of storing password blacklist?

I want to add a password blacklist that would prevent the 1000 most common passwords from being used in order to mitigate shallow dictionary attacks. Is there any negative implication of storing this ...
1
vote
1answer
533 views

How bruteforce works code wise

I was wondering how bruteforce methods work from a code level. How does the code get access to a login page for example and insert information into the necessary fields? And is the code able to ...
2
votes
1answer
643 views

What are realistic rates for brute force hashing?

I'm trying to gauge password strength assuming that the attacker has a hash of my password. Can anyone cite some realistic contemporary rates at which someone could perform various hashes? I know most ...
-2
votes
1answer
613 views

LophtCrack version 6.0.12 is not auditing my Administrator password [closed]

I am using LophtCrack on my Windows 8 OS. I was testing my password strength and the problem I am seeing it is not working. It doesn't reveal my Admin password, I've run the process for half an hour. ...
-4
votes
1answer
438 views

Feasibility of brute-force on online password [closed]

I am familiar with how offline brute-force attacks work. But for online accounts, assuming no social engineering, how feasible is it to brute-force attack a password? For example, is this dependent ...
6
votes
3answers
872 views

Can I spoof IP addresses when attempting to brute force a login?

I am testing my website with hydra brute-force software. But accessing my apache conf remote server file, it seems that an attacker can't log-in more a limited number of times per seconds. Does hydra ...
4
votes
1answer
306 views

WPA2 audit tool

For the purposes of my own research, I have a very modest budget to set up a modest WPA2 brute-forcer supported by GPU(s). I've done some homework: Brute-Force GPU Password Crackers How to setup ...
2
votes
1answer
1k views

Brute-Force GPU Password Crackers

Brute-force password cracker programs which claim GPU support include John the Ripper, ighashgpu, oclHashcat, and others. oclHashcat appears one of the more popular, but I am not sure which AMD/ATI ...
0
votes
2answers
342 views

Bruteforce Passphrase of Dictionary Words

Consider the all lowercase passphrase: "lazy fox haggles treaty" Assume all four words are in a dictionary of 2000. Bruteforcing word combinations, how long does it take to crack this password at ...
4
votes
1answer
134 views

Could a password hash that's prone to more collisions provide better overall security?

Website security breaches seem to be a common occurrence, giving the attacker password hashes that he can conduct a brute force attack against, often given him a list of passwords that will work on ...
3
votes
3answers
1k views

Avoiding Brute Force Attacks in a Web Based Login Form

My login form uses Ajax so it doesn't need to reload if the password is wrong. A PHP script process the request and creates the session if the credentials are right. My idea is to have the PHP script ...
4
votes
2answers
862 views

Web & insecure HTTP - Using RSA for encrypting passwords on the client side

I used client side password hashing in my register and login project. Its purpose is to prevent passive adversaries/eavesdroppers from discovering users' plaintext passwords when HTTP requests are in ...
1
vote
1answer
320 views

Use brute force to mitigate brute force

Just an idea I had, and I am sure there is a lot of material about this subject, so I am looking for a pointer as to where I can find more information. My idea is this... When storing a password in ...
2
votes
1answer
3k views

How long it will take to crack a RAR password?

I wonder how long it will take to crack 16 character alphanumeric WinRAR password for a mini supercomputer. As far as I know graphic cards are preferred over CPUs to crack passwords nowadays. If we ...
12
votes
2answers
525 views

Zip file with two password

I used this command to password protect a zip file on Linux : zip -P 9000 hash.zip hash.py and it creates the zip file just fine, then I wrote a program to test every possible password on it from 1 ...
17
votes
2answers
10k views

Why are GPUs so good at cracking passwords?

What is it about GPUs that lets them crack passwords so quickly? It seems like the driving force behind adopting good key-derivation functions for passwords (bcrpyt, PBKDF2, scrypt) instead of ...
1
vote
1answer
442 views

Pointers for john the ripper rulesets

I've been pouring over the JtR ruleset documentation and making little progress. I understand how to use it to make various permutations from a given wordlist, that's fine. However, I'm trying to ...
1
vote
2answers
723 views

Password Protected Zip: if attacker had one file, can use it to decrypt all files?

Consider a folder containing the following files: (file1.txt, file2.doc, file3.pdf) all zipped and password protected, if attacker had one of these file, can use it for decrypting all without knowing ...
12
votes
3answers
5k views

Cracking MS-CACHE v2 hashes using GPU

As most people here will know, Windows caches domain/AD credentials in a format known as MS-Cache v2. Obviously, these would be excellent passwords to gain during a penetration test when local access ...
4
votes
4answers
547 views

Insecure to require numbers in passwords?

Earlier, I went to a site that required a number and special character, and it got me thinking – wouldn't that make the password easier to brute force? If you assume most passwords have around 12 ...
3
votes
2answers
246 views

is it easier to get the original password if you have multiple hashes of it?

Most users tipically use the same password for multiple applications. Let's say all of these applications hash the password in some way. Would it be easier for an attacker to get the original password ...
3
votes
0answers
281 views

Can an attacker guess my password length from a hash? [duplicate]

Possible Duplicate: Possible to detect password length from hash? Is doubling your password adds more security? Considering I do not provide him any personal information relating to it, are ...
6
votes
7answers
746 views

How can I prevent users from using bad passwords in my web application?

There is a long discussion on whether it's the responsibility of the user or the system administrator to deal with the strength of the password. Obviously, the password is a very private thing, but ...
5
votes
5answers
1k views

Increased security with keepass

I am using keepass for securing passwords. I have a reasonable password, but if someone got hold of the file I am sure eventually they could brute force it. I was thinking of using a key file as ...
6
votes
3answers
290 views

How much added security do I really get with a longer key size?

Imagine I have a cipher which supports keys of 128, 192 or 256 bits. Suppose that there are no vulnerabilities in the cipher regardless of key length. I'm going to use it to encrypt something, and ...
2
votes
2answers
483 views

Is a password easier to brute force if it contains a repeating pattern?

My question is different from this previous question: Does repeating one word to form a password result in a similar pattern in its encrypted format?. I'm specifically wondering about brute force ...
1
vote
2answers
432 views

Known password length, brute force character in place?

We all know that brute forcing is a very slow process and trying all unnecessary possibilities is dumb. By knowing the password length, we can skip trying possibilities of other password lengths and ...