New answers tagged brute-force
You could use Burp Intruder. This is only in the paid version of Burp, but it's not that expensive. You would first capture a manual login using the proxy, then use Intruder to fuzz for valid passwords.
One usually evoked solution is Fail2Ban: this is a system which uses the firewall rules (iptables) to block incoming connections from IP addresses from which some kind of exhaustive search attack is apparently in progress. This, of course, won't work with a distributed DoS, coming from thousands of distinct IP addresses. In general, very few things resist a ...
For n-character passwords without two identical adjacent characters, @Stephen gives the solution: that's 94*93n-1 passwords. Reasoning is simple: you are free to use any of the 94 characters for the first character, then for each subsequent character you may use any of the 94 except the one which you just used, so 93. For n = 16, you may see that you keep ...
This depends on the character set/encoding you're working with. If we consider ASCII then there are 95 printable characters in total (see http://en.wikipedia.org/wiki/ASCII#ASCII_printable_characters). This includes lowercase and uppercase letters, digits, punctuation, and special (but printable) characters.
If there is a method faster than brute force, it represents a weakness in the hash function. Essentially what you're looking for is a modified preimage attack, just for a group of hash values rather than a single value.
Many security vulnerabilities are not by themselves exploitable. Often a combination of several vulnerabilities will result in an exploit. For example, if your application has a user enumeration vulnerability, this will allow an attacker who has stolen user credentials from another service to perform a more targeted (less easily foiled) attack against your ...
Top 50 recent answers are included