I have hooked the WS2 library with C++ in a game and found it sends a request to the server using http to check if my serial key is valid. http://warbandmain.taleworlds.com/handlerservers.ashx?type=chkserial&serial=MBWB-????-????-????-????-????

My question is if I send requests with generated serial keys for lets say over a week would it possible I get one right? The server returns -1 if it is false and an id if it is right.

Note: I don't wish to steal serial keys to sell on ebay or something. I don't even want to try this but I was curious if it would be possible.

  • Yes, it could theoretically be possible. However, it is very likely that the website will block you / your IP address if you send an unusually high (and therefore suspicious) number of requests. You'd also have to generate & send a lot of serials to have a chance of getting one right. Apr 17, 2016 at 13:38
  • it doesn't already tried it the server doens't display a visible sign of blocking my ip or logging it in their sql database I can guess away 24/7 but could this be considered a cyber crime? Apr 17, 2016 at 13:42
  • I wouldn't know if this is legal or not, so unfortunately I have no idea about that, sorry. It does depend a lot on your particular situation, where you are, local laws, and so on. Apr 17, 2016 at 14:06

2 Answers 2


I can't comment on this specific scenario as there are unknowns such as rate-limiting by the server (see comment by JonasCz), entropy of the serial keys, etc. Here is a general approach to considering this when protecting your own systems.

Each of the ? in the serial key can take one of a number of values as defined by an alphabet. For example, binary alphabet limits them to [0,1], hex limits them to [0-F], etc. The cardinality (c) of the alphabet is simply the number of options; binary = 2, hex = 16, and so on. There are 20 ? so, best case for protection, we have c^20 possible choices from which to guess (assuming a good entropy source for their original generation).


  • There are probably limitations on the actual choices in the form of checksums or authentication codes to validate a particular serial number. For example, the last 4 characters may be a truncated HMAC of the preceding ones, with security provided by the HMAC's key. There may simply be a non-cryptographic checksum which doesn't have a secret key.
  • A variant of the birthday problem - we're not looking to match a specific serial number. There are a set of true serial numbers and a set of guessed ones; an intersection of these sets that is not empty is a success.


Once we have reduced the search space given the caveats we can assess the feasibility of the brute-force attack with this excellent calculation. ("Thermodynamic Limitations" in Schneider B. Applied Cryptography pp. 157‐8).


Sure you can, but it will be a long process to bypass all the rate limits, per-IP limits, e.t.c. But occasionally you will hit it for sure.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .