0

I am considering attempting to perform an SSH brute force attack on my own device in order to test its security, but I have run into an issue with the wordlist. I know my own password format, as well as that of a few other devices, so I have used Crunch to create a wordlist that fits the parameters of the passwords.

The resulting file is almost 15GB. How can I efficiently test all of these passwords? The RAM on my device cannot even hold this file all at once, but I know that the password to every single device I test against will be somewhere in the list.

Is it possible to cut the large file into a bunch of smaller files and run a sort of multi-threaded brute force attack using each of the smaller files? Thanks in advance!

Improve this question
6
  • 2
    Why do you need to keep the 15GB in memory?
    – forest
    Commented Dec 12, 2017 at 6:31
  • 4
    Why do you need to perfrom a brute force? You know your password. You have the list of passwords you want to try. grep should be the only tool you need... How does actually running a brute force "test its security"? Unless you have installed something like a ratelimiter? - which should take nowhere near 15GB of passwords to kick in.
    – Hector
    Commented Dec 12, 2017 at 9:13
  • 1
    I, too, am confused about what you want to test and what outcomes you expect. Is multi-threading most important to you, or just finding a way to process such a large wordlist? Have you looked at some of the bruting tools to see what options they provide?
    – schroeder ♦
    Commented Dec 12, 2017 at 9:48
  • 1
    Brute force programs don't load the entire list into memory, they buffer a few MB maybe even 100mb, and when that is almost used up it reads in another batch discarding the failures as it goes.
    – cybernard
    Commented Dec 13, 2017 at 0:31
  • Why not attack the hash(es) in your shadow file using a tool like John the Ripper or Hashcat? That'll be significantly easier, and you'd only need a few tests on the SSH server to see how to convert your timing. Also, consider something like fail2ban that can block IPs with too many failed attacks in too small a time window.
    – Adam Katz
    Commented Dec 13, 2017 at 16:50

1 Answer 1

Reset to default
1

The resulting file is almost 15GB. How can I efficiently test all of these passwords? The RAM on my device cannot even hold this file all at once

There is no reason you would need to keep the entire file in memory. Just read the file part by part. Achieving this and speeding it up is just a matter of how you code it.

In addition, if it's your own device then you can cut out the SSH client and server completely and simply perform the brute forcing directly on the password hashes in your shadow file.

Instead of reinventing the wheel, there are pre-existing solutions for brute-forcing hashes as quickly as possible. There are also pre-existing lists/generators so you can use what a real attacker might use to get a bit more of a real-world test.

It looks like you're trying to brute-force your own passwords using a generator tailored to your own password format. The usefulness of this is dubious. Are you just trying to get a sense of how brute-forceable your passwords are? The use of your custom generator would render the results fairly meaningless. Even if you switched to pre-existing brute-forcing tools with pre-existing wordlists/generators the results will be of limited use (unless you succeed of course!): you don't just want passwords that can't be brute-forced easily, you want it so that it has additional entropy spare even after that point so it's practically not achievable. You can get a general sense of how much entropy exists in your password by inspecting it and having a good understanding of how much you need.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .