I have hooked the WS2 library with C++ in a game and found it sends a request to the server using http to check if my serial key is valid. http://warbandmain.taleworlds.com/handlerservers.ashx?type=chkserial&serial=MBWB-????-????-????-????-????

My question is if I send requests with generated serial keys for lets say over a week would it possible I get one right? The server returns -1 if it is false and an id if it is right.

Note: I don't wish to steal serial keys to sell on ebay or something. I don't even want to try this but I was curious if it would be possible.

  • Yes, it could theoretically be possible. However, it is very likely that the website will block you / your IP address if you send an unusually high (and therefore suspicious) number of requests. You'd also have to generate & send a lot of serials to have a chance of getting one right. – JonasCz - Reinstate Monica Apr 17 '16 at 13:38
  • it doesn't already tried it the server doens't display a visible sign of blocking my ip or logging it in their sql database I can guess away 24/7 but could this be considered a cyber crime? – Francesco Ventura Apr 17 '16 at 13:42
  • I wouldn't know if this is legal or not, so unfortunately I have no idea about that, sorry. It does depend a lot on your particular situation, where you are, local laws, and so on. – JonasCz - Reinstate Monica Apr 17 '16 at 14:06

I can't comment on this specific scenario as there are unknowns such as rate-limiting by the server (see comment by JonasCz), entropy of the serial keys, etc. Here is a general approach to considering this when protecting your own systems.

Each of the ? in the serial key can take one of a number of values as defined by an alphabet. For example, binary alphabet limits them to [0,1], hex limits them to [0-F], etc. The cardinality (c) of the alphabet is simply the number of options; binary = 2, hex = 16, and so on. There are 20 ? so, best case for protection, we have c^20 possible choices from which to guess (assuming a good entropy source for their original generation).


  • There are probably limitations on the actual choices in the form of checksums or authentication codes to validate a particular serial number. For example, the last 4 characters may be a truncated HMAC of the preceding ones, with security provided by the HMAC's key. There may simply be a non-cryptographic checksum which doesn't have a secret key.
  • A variant of the birthday problem - we're not looking to match a specific serial number. There are a set of true serial numbers and a set of guessed ones; an intersection of these sets that is not empty is a success.


Once we have reduced the search space given the caveats we can assess the feasibility of the brute-force attack with this excellent calculation. ("Thermodynamic Limitations" in Schneider B. Applied Cryptography pp. 157‐8).

| improve this answer | |

Sure you can, but it will be a long process to bypass all the rate limits, per-IP limits, e.t.c. But occasionally you will hit it for sure.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.