New answers tagged

0

When using CloudFlare (like mentioned in one of your comments. Two things happen. The server and application both are not aware that CloudFlare (a reversed proxy) is used. To fix this you need to tell the used software (WordPress and fail2ban) where to find this original visitors IP. Otherwise I'll be working with the CloudFlare IP's (since that's the new ...


1

I'm guessing you are getting many of the failed logins from other countries outside of the U.S. What I recommend for WordPress is to download an IP Blocker from the plugins and this gives you the ability to block certain countries or all the countries besides the ones you want. In my case I have a website that is only to be viewed in the U.S. so I blocked ...


0

If you have an access to the server then you can install fail2ban. You will need to set up jail for the wordpress /etc/fail2ban/jail.d/wordpress.conf [wordpress] enabled = true filter = wordpress logpath = /var/log/auth.log port = http,https $ service fail2ban restart For more details check here. Make sure that you are not using default username ...


6

Answer: No, a bruteforce attack would most likely fail. http://www.payetteforward.com/my-iphone-is-disabled-connect-to-itunes-fix/ According to this site, and anyone who has ever been a mean big brother, there are only 10 times you can attempt to unlock an iPhone before it is completely locked and needs to be restored. 1-5 failed attempts - The phone will ...


0

I think there might some reasons behind for not using lockout/retry counter: For any invalid username input or good username/bad password input, it should always return error message 'Invalid username or password'. Or the error message will leak user information. For lockout, it is not valid non existing users; locking out existing users might even worse ...


2

Careful! Based on what you're saying, you've already donned the Hat, and now it's up for interpretation whether it's a Black, Grey, or White Hat. Depending on localities, you may actually have already committed a felony. System administrators can get very protective of their systems, and they don't always see the honest-guy-shows-you-your-lock-is-broken ...


1

Yes, this is a serious security oversight and needs to be reported so it can be fixed immediately.


2

Can you brute force Dropbox URL? Well, yes, you can also brute force AES256 encrypted file. I think what you are really asking is, would you be successful? It's quite unlikely. Currently, Dropbox share URL is 11 characters that consists of lowercase alphabets and numbers (36 possible characters). This gives a key space of 36**11 ≈ 1.31621704 × 10^17 ...


2

Technically yes it would be possible to attempt a brute-force attack but other controls may prevent the attack from being successful. The business to customer relationship for a site like DropBox is very different from an URL-shortner which makes it much easier for a site like DropBox to also deploy automated attack countermeasures like blocking or slowing ...


5

The thing about brute forcing a TOTP token is that you have to guess right at the right time. So, if you don't want to lock a user out after x failed attempts (which is common practice) you can slow failed attempts down to the point where the odds of getting the TOTP right are statistically insignificant. For example: 6 digit TOTP token has 1,000,000 ...


1

Many file formats start with a magic number (a byte sequence) that you can look for. Wikipedia has a list.


16

You absolutely can tell with varying degrees of certainty if a file, or even string, was successfully decrypted. Most of the challenges at cryptopals depend on it. I have begun to make a tool for ciphertext bruteforce and analysis that automates this very task. You can find it here if you want to take a look. (it needs a lot of cleaning up, don't judge me) ...


7

The other answers here are excellent for the general case. For a class assignment, I suspect that the professors want to make it very easy to tell when you have the file decrypted. For example, are the files you're decrypting text files that show a message when they're correctly decrypted? If so, you can take a dictionary in your language and check wether a ...


0

Other answers have covered most aspects, but another point is that, if you have access to the API that created the encrypted files, you could encrypt your own know file and brute force it (here you have something against to compare). Once you get the key use it on the other files.


10

If you have some idea what the cleartext is, you can use that knowledge guess when you've might have cracked the ciphertext. If you think that the cleartext is english, for instance, start looking for english words in your decrypt attempt. If you think the cleartext is a zip file, zip files have a signature at the beginning of the file. Look for that ...


49

You really can't, if you're just encrypting / decrypting text. If you know that the encrypted string is "kdo" and the encryption method is a Caesar shift, the plaintext could just as easily be "IBM" as "HAL". You'd have to have some idea of what the plaintext "looks like". For instance, if you know the plaintext is the name of a Stanley Kubrick character, ...


2

If the encrypted file is a text you need to check if the phrases inside the file have a sense or not, but if you need to discover something that it's not a word or a phrase (es. password or random letters) you must try all different possibilities. For example, I have a login password (random letters) encrypted with Caesar cipher. I must try, in the worst ...


0

You can try brutus. It's easier than hydra. In order to perform a brute force attack, you need to understand the HTML source of the login page. The correct field values must then be fed to your brute forcer of choice.


5

In the case you constructed, even a 4-digit PIN would be fine. In fact, it's very similar to the iOS (and maybe Andriod?) PIN lock screen that wipes your phone after 10 incorrect guesses. No real hacker will try brute-forcing passwords against an application server, it's just too slow. Over the internet you can get at best what, a couple of hundred guesses ...


2

Your assumption at 1. is incorrect. Consider an email system, where users log in with a password. In that case, the target may well be either the emails (which might be stored in a database, but equally may be in individual files, or mailbox files), or the ability to use the system. In this case, access to the database wouldn't provide either of those ...



Top 50 recent answers are included