Tag Info

New answers tagged


(AFAIK) There is not an explicit "tries per second" config option in HYDRA, normally you can define the number of tasks that will be involved in the attack. I have checked the default option and it is 16 (in the command line utility), so I believe that the service you are trying to test against might have a big latency or some kind of delay before answering ...


Are you trying to brute force the windows system password or 3rd party software password? If your are cracking over the network, try using a faster network speed might help. Or use those existing brute force software.


It looks like you're performing an "online" attack, in which case the speed at which you can work is limited by how fast your target computer is willing to respond to login attempts. Since your code isn't (or at least, shouldn't be) the limiting factor, there's nothing you can do to speed up the attack. If you can acquire the password hashes, you can ...


You could use Burp Intruder. This is only in the paid version of Burp, but it's not that expensive. You would first capture a manual login using the proxy, then use Intruder to fuzz for valid passwords.


One usually evoked solution is Fail2Ban: this is a system which uses the firewall rules (iptables) to block incoming connections from IP addresses from which some kind of exhaustive search attack is apparently in progress. This, of course, won't work with a distributed DoS, coming from thousands of distinct IP addresses. In general, very few things resist a ...


For n-character passwords without two identical adjacent characters, @Stephen gives the solution: that's 94*93n-1 passwords. Reasoning is simple: you are free to use any of the 94 characters for the first character, then for each subsequent character you may use any of the 94 except the one which you just used, so 93. For n = 16, you may see that you keep ...


This depends on the character set/encoding you're working with. If we consider ASCII then there are 95 printable characters in total (see http://en.wikipedia.org/wiki/ASCII#ASCII_printable_characters). This includes lowercase and uppercase letters, digits, punctuation, and special (but printable) characters.


If there is a method faster than brute force, it represents a weakness in the hash function. Essentially what you're looking for is a modified preimage attack, just for a group of hash values rather than a single value.

Top 50 recent answers are included