New answers tagged

0

But how do they know that I do exist? They know that something exists on that IP address because their scanner is telling them so. Most likely they didn't come looking for you, they just stumbled across that IP address by scanning large chunks, or the entire internet. http://blog.erratasec.com/2013/09/masscan-entire-internet-in-3-minutes.html


9

But how do they know that I do exist? They don't know that you exist. They don't know they're talking to you: they just know they're talking to a computer with a particular IP address. IP addresses are a lot like phone numbers. If you dial a legitimate area code followed by a random number with the right number of digits, there's a decent chance ...


19

The IPv4 address space is limited to only 4,294,967,296 addresses.[note 1] Given enough bandwidth, it becomes trivial to scan every single IP address out there, especially if you're the owner of a botnet consisting of thousands of hacked devices. With IPv6[note 2], things are a bit more tricky: with over 300,000,000,000,000,000,000,000,000,000,000,000,000 ...


63

You can't hide your IP address on the internet. They aren't secret. Pretty much what @DeerHunter said. It's trivial to scan the entire internet. If they want, they can target all-known digital ocean droplets that are online. They can do this on a timer so that when you go offline, or online, it will just keep trying as those may be high-value targets that ...


0

The answer is NO, and it seems that you're mixing up two different things : Checksums and Hashes are one-way Integrity checkers. The purpose of their usage in that matter is to make sure that the data was not corrupted, and nothing else Recovery codes are the ones you're using if you need to recover your data by code provided. The most shining example is a ...


0

Hashes are designed to be one way. Its easy to travel from left to right, but it is practically impossible to travel from right to left when talking about Hashing.


0

Of sorts, you can always try to hide yourself. If I was to do something and didn't want to get caught, I would use TAILS OS. If my only choice was Windows, why not use a VPN that isn't based in the United States? Or use proxy-chain or TOR? All of those would HELP hide your identity. Theoretically, if you were to brute-force a website's Admin account, and ...


0

If you do not have specific permission testing the system in question the most secure way would be to not brute force at all. However if you do have permission you have to ask yourself: How hidden do you actually have to be? If you just need a proof of concept that you can show then using a simple proxy, would be sufficient. As well as keep cost and ...


0

The system is to blame for a breach in the system. If they allow millions of logins per second, and an unauthorized user gained access then IMO that's on them. If the system decides to not encrypt persons private data (looking at you OPM) then this blame is on the system. Using outdated operating systems and software; that blame is on the system. I think ...


6

Depends what you're defending against, really. Trying to log into a web application, attempts should indeed be restricted in some way. IP rate restriction is a good start, username level rate restriction is better, combining the two is even better. However, imagine that I have a long list of usernames and passwords from a previous unrelated breach. If I ...


1

Just don't confuse password cracking techniques with brute force. Brute force literally means starting with 1 character trying all possible alphabetically, then moving to 2 characters, 3, 4, etc... Once an algorithm or a heuristic logic is applied it not called brute force anymore. So why are people still talking about brute force? Reason is that for ...


3

One option: They can clone the whole system to a computer or another phone. After that, they will do the tries. After it wipes itself, they will clone it again. Second option: If it is the data what is going on, they can copy it to a PC and crack it there. No wiping applies on that in this case ...


8

Do as many mitigations as you can. Your goal is to force a wide variety of potential attackers to spend more effort, resources, computer time (and thus electric bill), and most especially "skilled" (rare or scarce, and thus valuable) person-hours. No one protection works against every threat. Not every threat can be protected against while still remaining ...


1

Here you go: Generete SSH keys + protect them with password Allow only specific user to login (AllowUsers) Allow from specific IP username@192.168.1.1 Change default port Create firewall rules and last thing install fail2ban.


0

You successfully blocked that specific ip, but let me tell you something you're gonna get thousands of such malicious computers trying to brute force your ssh in order to get into your box. Some tips: Switch to authentication via certificates than passwords Change default ssh port (this is quite helpful - default is 22) Some lower level tips: Disable ...


0

It is effectively impossible, due to information theory. Effectively impossible, as in "heat death of the universe" becomes a legitimate limiting factor on your search. You have a 2,000,000 byte (2MB) slice missing. A hash like SHA-1 has 20 bytes of information in it. By information theory, we should expect that there are 1,999,980 bytes which are still ...


0

It´ll basically take too long to achieve a satisfying result, addressing both: generating the missing video-part (according to computable criteria) and sorting the best ones out of them (that needs human intelligence or extremely high developed AI). Even if you finally have a nice video matching all criteria, you´ll never know if the original movie had the ...


1

A comment but it's too long: As others have shown, this isn't possible. However, there is a related problem that certainly is reasonable: Ok, you can't reconstruct that 200mb video that was split into 100 2mb files of which you have 99. However, you can create another file that will be a hair over 2mb that will allow you to reconstruct any one missing ...


1

It is hard if the underlying file has high enough entropy. If you know something about the underlying data, then you may well be able to recover it. For example, if there is a hacker anywhere in the vicinity it won't be long at all before someone tells you what I md5 hashed to get: 73868cb1848a216984dca1b6b0ee37bc However video usually has lots of ...


6

Let's say you have a computer that has infinite amounts of processing power, and can reliably check every possible message against every possible hash in a short time. Here's the problem you now face: collisions. What's a collision? Many different files can match the exact same signature. Many different messages can match the exact same signature. Hashing ...


5

You can try Wizcraft's block list, and format it accordingly. At the time of my post, this blocklist was last updated on Thursday, 24-Dec-2015 11:01:52 MST. Keep in mind, Taiwan is not part of Mainland China, but that Hong Kong now belongs to, and is controlled by Beijing. If you only use your server in America exclusively, you could use all of those rules ...


58

A simple answer, NO. It is like asking, if I know, that x%4 = 3, is it possible to find the value of x? No. Surely, there would be infinite values of x satisfying this equation, but you wouldn't simply know which one is correct. Similarly, many(or infinite) video clips could result in a given hash value(obviously, infinite video clips have to be mapped to ...


12

This is not possible no matter how fast your computer is, simply because you cannot recreate the correct information out of practically nothing. You are actually asking for restoring 2 MB from 32 byte (size of SHA-256) or at most 64 byte (SHA-256 for chunk and for total file). This would be an ratio of 1:65536 or 1:32768. Given that video is already ...


6

You could not reproduce the file in any reasonable amount of time. The reason is that the only way to 'reverse' a hash is via brute-force, and considering how large the original file was, it would take you that exact amount of bytes to brute force. Let's say you have a video file that is 100MB large, precisely. 1MB = 1,000,000 bytes 100MB = 100,000,000 ...


4

Metasploit's http_login module doesn't support arbitrary HTTP headers. If the site only responds with the XHR header included, then you might want to use a more versatile tool like hydra. # indicates the beginning of the URI fragment. This isn't a part of the URI used for logins, but is typically used to pass options to the front-end web framework.


0

Thanks @bonsaiviking for all of your help. A more in-depth analysis of the --script-trace revealed the primary issues were the user-agent and brute.emptypass=true. Also, since the first pass of the script supplies bogus creds i needed to use a string that matched when a bogus username was supplied aswell a string match on the correct username ("error"). ...


2

Let's start with making sure we have a clear understanding of what 'brute forcing' is. A brute-force attack is when an adversary attempts to guess every single combination of characters, starting at one length, and increasing the length by one until the password is cracked. e.g. 1, 2, ... a, b, ... 11, 12, ... 1a, 1b, ... aa, ab, ... etc. Depending on the ...


1

First and foremost rolling your own crypto is almost always a bad idea see Why shouldn't we roll our own?. Now that that requirement is out of the way lets take a look at your question. In this case you have to ask what are you protecting against. The AES encryption (assuming that it is implemented correctly and there are no side channels) will protect ...


1

Check the mask_attack page of the hashcat wiki. For your case: oclHashCat64.bin -m 2500 -a 3 -1 ?l?u?d ?1?1?1?1?1?1?1?1 [YOUR HASH OR HASH FILE] "-m 2500" specifies the WPA/WPA2 hash type, per hashcat documentation "-a 3" is the brute force attack mode "-1 ?l?u?d" says to use the character set of lowercase, uppercase, and digits (the character set you ...


0

I think it's fair to say that 5 truly random letters are going to be less likely than 5 repeated letters, even if "aaaaa", isn't practical to type...the people who make these passwords have avoided much practical thinking.


1

You need to supply the correct syntax. Here is an example: hydra [TARGETIP] http-form-post "/TARGETPATH/TARGETPAGE.php:user=^USER^&pass=^PASS^:Bad login" -L users.txt -P pass.txt -t 10 -w 30 -o hydra-http-post-attack.txt 1st field (before the 1st colon) = location of the target page 2nd field (before the 2nd colon) = user & password parameters 3rd ...


0

Since you're using Hydra i'm assuming you're on Kali Linux, so 'crunch' should be installed. In which case, you could do something similar to this to generate your wordlist (1 to 10 character alphanumeric): crunch 1 10 abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789 | grep -Ev '(.)\1' This may eat up a fair amount of hard disk space though.


3

There are various "tricks" to make decryption of an iPhone harder. One is that part of the decryption key is stored in the CPU of the iPhone, different for every iPhone, and not accessible by anyone, including Apple. That means if you remove the flash drive from the phone and connect it to the worlds fastest supercomputer, that supercomputer has to crack ...


6

Hardware In a classic approach, you can have the data encrypted by a long and secure random key that is not vulnerable to any brute force attacks, and have that long key stored within a secure chip that will disclose (or apply) that key only when presented with a PIN code under certain conditions that include a rate-limiting of how frequently PINs can be ...


21

Having only 1,000,000 possible combinations, an encrypted zip-file with a 6-digit numeric password, could be brute force cracked within a second. This depends on the hashing or encryption algorithm, and the hardware as well. But for an iphone (let's say iOS9 if it matters), it is said that it would take years to do so. Again, this depends on ...


3

The http-brute script documentation states that it performs "brute force password auditing against http basic, digest and ntlm authentication." These are HTTP authentication methods, but what you are looking for is form-based authentication. The http-form-brute script does what you want. You can use the uservar and passvar script-args to tell it which ...


1

You can also slow down the password guessing attacker fairly easily. In the file /etc/pam.d/sshd, you can add a line like this: auth optional pam_faildelay.so delay=7000000 On every failed sshd login attempt, the PAM module will wait 7 seconds. You may want to increase or decrease the delay, because if you fat-finger your own password, you wait 7 ...


1

I fired up Zenmap, pulled up the listing for the http-brute script, and plugged in the address, user cred file, and password cred file in the appropriate GUI fields to produce command line arguments for them. The command line string that Zenmap output for me: [initial output from Zenmap was here, and was incorrect because of the way in which I selected ...


3

Since all SSH logins to your server are redirected via the same local IP address, I would advise to use fail2ban with care, if you decide to use it. Installing fail2ban on the same server as sshd will result in the IP 172.25.1.1 being blocked on the spot. After that, nobody will be able to login via SSH to your server. If you can install fail2ban on the ...


19

Quick note added about fail2ban, as a lot of people have been mentioning it: The frontend is a corporate firewall, the backend only sees the redirection/proxy that comes from the firewall. So no, 172.25.1.1 is not an internal machine compromised. Fail2ban in the backend would only block all possibility to use SSH for stretches at a time as it only sees ...


8

You are surviving the attack, from appearances. SSH is doing what it's supposed to do. However, see below for some steps you should take ASAP to ensure continued survival. Also, and unfortunately, a system inside the network has been compromised. Too common these days. You should ascertain the nature of this apparently interior attack, but do not assume ...


5

The standard look from the logs seem to be a common brute force attack as the names enlisted in the logs are from a standard dictionary being used. Even the common word-lists consider these as the primary target usernames. Also, the injection is from a Private Class B IP. Don't worry though, as long as the passwords that you have enforced are strong enough ...


28

Yes, you're being bruteforced. But I don't think you should worry about any bruteforce you detect coming from the internet. You should, however, be worried about brute-force attacks coming from your own network. Being bruteforced is very common, and as long you don't use passwords for SSH (or use good passwords), the attack won't be successful at all ...


40

Yes, this looks exactly like a brute-force attack and after googling admins phoenix piglet rainbow it looks like this is the wordlist the attacker is using: https://github.com/hydrogen18/kojoney/blob/master/fake_users Check out line 116 onwards. The wordlist is being used in the exact same order. This appears to be a generic wordlist as it also present on ...


63

Yes it looks like you are experiencing a brute force attack. The attacker is in on a class B private address, so it is likely to be someone with access to your organization's network that is conducting the attack. From the usernames it looks like they are running though a dictionary of common usernames. Have a look at 'How to stop/prevent SSH bruteforce' ...


1

Server-side validation collates submitted value with a text representation of the captcha image, not the ascii sum or etc. Let's take a look at standard 5 a-z chars captcha example: Quantity of all combinations from aaaaa to zzzzz is 26^5 = 11881376 combinations. Quantity of all ascii sums of our captcha is 610-485+1 = 126 So, if we have an ascii sum ...



Top 50 recent answers are included