example.com/[a-zA-Z0-9] the code can be any mix of numbers + uppercase/lowercase letters and it's 5 characters. How long would it take to brute force or is there an easier/faster way to do it?

  • 4
    The number of tries you need at most is simple math: 62^5. On average you'll find a hit after half the maximum. But how long this takes depends on how fast the server responds and if it employs measures against brute-forcing, i.e. can not be said based on your information. – Steffen Ullrich Jan 15 at 18:00

This wont take much long but as mention by @steffen it depends on the server response if your server is responding fast then i could suggest with gobuster it will take maximum five hours with all possible combination. use atleast 50 threads.

gobuster -u https://examplecom -w your-wordlist  -t 50 

generate the combination first and then give it to go buster it will complete with five hours.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.