Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [brute-force]

An attack using every possible input to attempt to produce the correct output. Typically the method of last resort when no weakness allows the use of a more restricted input set. E.g. trying all possible (or likely) passwords, in an attempt to guess the correct one.

1
vote
0answers
14 views

Manage Logs of Excessive Member and Server Authentication Failures

Currently, in our SIEM environment, we are attempting to reduce noise and any non-actionable items. One of the most frequent items we receive on a weekly basis is a report based on excessive member ...
38
votes
8answers
13k views

Is brute force a probable threat even if you enable CAPTCHA and rate limit logins?

Let's assume CAPTCHA is enabled with account lock out control (after five continuous failed attempts, the account will be locked for 15 min) on a system. Is brute force still a probable threat?
0
votes
1answer
45 views

Brute-Forcing DVWA login page with hydra

I'm learning how to brute force web login pages with a popular brute force tool called "Hydra". I'm using Kali Linux (VirtualBox) to do this. I've installed DVWA (Damn Vulnerable Web Application) and ...
2
votes
0answers
55 views

Chances Google Cloud VM was hacked?

I started a Google Compute VM instance the other day to run a trading algorithm I developed. I know very little about security and stupidly left rdp-allow open on port 0.0.0.0/0. I was concerned about ...
1
vote
1answer
124 views

Are partial passwords a security improvement over full passwords?

With full password authentication, you need to enter the full password every time. With partial password authentication, you're asked for some subset of the password each time, and which characters ...
0
votes
1answer
66 views

Why are SQL servers not attacked as frequently as ssh servers?

I have a server running with both SSH and MySQL accessible to the public internet. Both run on default ports (22 and 3306). The ssh server is attacked by bots all the time. This is the output of ...
0
votes
0answers
26 views

Disconnect two Bluetooth connected devices

Suppose, two Bluetooth devices are connected in range. I know both their Bluetooth MAC addresses. Since these devices are constantly sending commands to each other, can't I just spoof on device's ...
1
vote
1answer
114 views

Lost password for encrypted external HD

Have an old filevault encrypted external hard drive. Would like to access but have forgotten the password. However I do remember the style of password (XKCD four word style) and remember two of the ...
1
vote
1answer
86 views

Slow Hashing Without a Salt?

I'm trying to design a security scheme that involves a shared secret but isn't a traditional account password situation. The server would store a set of "keys", each of which has a blob of data ...
1
vote
1answer
42 views

Please explain the vulnerability for the pre-shared Key for IKEv1 brute force IPSec

After the vulnerability was released for IPSec IKEv1 PSKs, our organization decided to increase the size and complexity of the PSK. However, upon releasing the new PSK we had a few issues: ...
0
votes
1answer
70 views

How is my employer accessing my router when employer's laptop is wirelessly connected to my home network

I have a modem bridged to a modern router running open source software and heavily secured. I have all connections to the router through a personal vpn from a dedicated provider. During work from home ...
0
votes
0answers
27 views

Best techniques for periodically creating very secured but easy to remember passwords [duplicate]

I need recommendations on techniques to creating highly secured, yet very easy to remember passwords. I need to create multiple passwords for personal accounts which must change periodically (every ...
1
vote
1answer
62 views

hashcat specific brute force

Is this scenario possible: I know the first three letters of the password (exact), i know the password is between 10-14 characters, i know the rest of the characters are "b,t,p,1,3,6,7" which can be ...
1
vote
1answer
320 views

Best tool to BruteForcing RDP

I have tried many tools and to do not seem to be successful with locking out an account I am testing on my network with an RDP domain. I used crowbar, ncrack and THC hydra but they don't seem to be ...
0
votes
1answer
70 views

Protect MySQL against brute-force attacks on dedicated CentOS 7 server

I have a database in a dedicated server (CentOS 7) setup by an external provider. I see a disgusting amount of brute-force attempts in MySQL log file every day. I know the best option would be to not ...
0
votes
1answer
127 views

Are there any good brute force programs in C#? [closed]

I'm planning to research & learn from brute force methods, but all the popular ones I found like John the Ripper or hashcat are written in C & OpenGL which I don't have much knowledge about so ...
0
votes
1answer
225 views

THC Hydra on Windows RDP Domain

I am testing a bruteforce on a windows rdp server within a domain. It seems to not be working because nothing is locking out the account I am targeting. How do you specify a domain username? I tried ...
2
votes
2answers
184 views

Breaking .kdb (KeePass 1.x) file

During a penetration testing lab, I have obtained access to a .kdb file of a KeePass 1.25 (password management). Therefore I tried to find a way to obtain the file key file or key and after ...
2
votes
0answers
83 views

Brute force hex password with exactly two special characters using JohnTheRipper

I want to optimize the way I'm using John the Ripper. I have a password with a know length (9) that consists only of (lower-case) hex characters and exactly two special characters. First I tried ...
0
votes
2answers
69 views

Cryptography as an ecosystem

I was thinking about a thought experiment. Let's imagine a world full of crackers such that whenever you encrypt something there will be someone who will try to crack your cryptographic key through ...
1
vote
1answer
84 views

Online brute force attack which will continue in background [closed]

I don't have enough bandwidth for brute force dictionary attacks so I'm searching for a website or a way that I can do brute force attacks as a background process even if I turn my internet ...
0
votes
1answer
252 views

Is this possible to brute force 25 billions billions password in less than a month?

i'm using Hashcat for a while & try to solve this challenge: is this possible to crack at least half the possibilities combinations password of 10 character using 94 characters from keyboard with ...
2
votes
2answers
74 views

is there an upper limit on time to brute-force a password, based on acceptable login delay and hardware speed ratios?

Suppose a user uses a password to log in to their PC. When the user logs in, the PC applies a cryptographic function to the password and compares the ciphertext to the stored ciphertext of the known ...
0
votes
3answers
183 views

Brute forcing - How difficult?

I'm doing a research project and I have a question regarding how difficult it would be to brute force something. Say there is a piece of text - "My name is James" Removing the whitespaces yields "...
1
vote
1answer
63 views

Is it possible to specify multiple values for failure condition (F=) using Hydra?

I want to brute-force a site using Hydra (https-post-form) that I don't know valid login credentials for, so I cannot specify a value for success condition (S=). Failed logins result in a redirect ...
1
vote
2answers
84 views

Is something like fail2ban necessary for a rate-limited key-only (no password) ssh login?

As far as I understand, bruteforcing ssh is only attempted for passwords, not keys (barring edge cases where presumably the NSA wants to break in). So if a server has disabled (in addition to root ...
0
votes
1answer
184 views

How to configure hashcat to only hash fixed length passwords with N digits?

I know of mask and dictionary attacks. Using a mask attack, I specify the charset for each position in the password pattern, e.g., ?1?1?d?1?d?1?1?d, where ?1 := ?l?u?s. But how do I tell hashcat to ...
0
votes
1answer
210 views

Which hashcat hash mode is closest to that used by BitLocker?

I'm trying to get a hypothetical benchmark for the BitLocker hash mode if Hashcat would support it. Which (-m) mode is closest to BitLocker's latest/default algorithm? From Google searches I learned ...
1
vote
0answers
115 views

How to recover forgotten AES-256 password with bruce force?

The password was set on a flash drive using LaCie Private-Public for Windows 10. The password is 12 character long. For each character, I know if it is a number, special character, lower case letter ...
0
votes
0answers
46 views

John the Ripper, mask and rules [duplicate]

I have obtained a hash for a password that I know is 10 characters and contains lowercase, uppercase and numbers. No special chars. I have created the following incremental mode: [Incremental:myown] ...
89
votes
8answers
15k views

Can secret GET requests be brute forced? [duplicate]

Say, I have on my server a page or folder which I want to be secret. example.com/fdsafdsafdsfdsfdsafdrewrew.html or example.com/fdsafdsafdsfdsfdsafdrewrewaa34532543432/admin/index.html If the ...
0
votes
1answer
180 views

Avoid brute force attacks on oAuth authorization server

I've been looking into the oAuth 2 authorization framework for a while now. Yesterday I started wondering how to prevent a brute force attack during the Authorization Code Grant flow (https://tools....
5
votes
3answers
569 views

How to protect our server from brute force attack? [closed]

One of the most common cyber attack is Bruteforce , what are the mechanisms available to protect this attack and how industry apply these mechanisms to mitigate the attacks (best practices)?
3
votes
1answer
79 views

“Targeted” Brute-Force an Local App password

I can't remember my password for a locally installed app but I wrote it down poorly and am sure of 6 letters/numbers out of 11. I generated a list of all the possibilities given that the badly ...
7
votes
1answer
295 views

Brute forcing encryption password (self destruct after 4 attempts)

My colleague at work lost the password to his external hard drive (HDD not SSD), a WD Elements. He remembers that his password was simple and 8 characters maximum. The problem is the encryption ...
0
votes
0answers
76 views

Hydra ignore http header usage

My http responses produces a '0' when there a valid user is detected and '1' when an invalid user is detected. I used the following hydra commands: hydra URL http-form-post "/checkUser.php:username=^...
3
votes
1answer
156 views

Can passwords be brute-forced through RDP?

We had a small discussion about a security-related article at work today, and I was a bit surprised about one thing - they claim that some attackers managed to brute-force guess the password of ...
0
votes
0answers
206 views

hydra http-post-form question about <form parameters> and <failed login message>

I have 2 question after reading this guide on how to evaluate router admin password: https://buffercode.in/hack-crack-web-form-passwords-using-hydra-burpsuite-kali-linux/ This is the command format: ...
-1
votes
1answer
265 views

Can brute force or dictionary attacks be detected when using the WiFi protocol?

Can the WiFi protocol recognize when a brute force or dictionary attack on it is occurring? WiFi gives the user an authentication failed message after entering an incorrect WiFi password several times....
-4
votes
1answer
230 views

How can WPscan bruteforce passwords without hitting any limit rate?

I've just watched this video which shows the attacker bruteforcing both usernames and passwords. How can this be achieved without hitting any limit rate? Does it mean that WordPress doesn't provide ...
0
votes
0answers
19 views

Protecting API - Using 3rd party? or Application Firewall? [duplicate]

Our company has a mobile app with a lot of traffic and we want to protect its API. How can we reduce brute force attacks? Does account lockout is the fastest and proper way to achieve protection? We ...
1
vote
1answer
268 views

Maximum tries for 2FA code?

I am building a website and I am implementing two factor authentication (2FA). The second factor will be a random 6 digit code like those from Authy. This site will store very confidential information....
2
votes
1answer
254 views

Tools and computer specs for password cracking [closed]

To polish my penetration testing skills I want to attempt to crack NTLM/NTLMv2 hashes (via dictionary/wordlist attack) extracted from Active Directory / SAM database, where the underlying passwords ...
5
votes
2answers
235 views

Is there a way to see what is program is causing RDP attempts on computer

One of our servers (running RdpGuard) shows multiple failed attempts from specific users' machines (3 to be exact) and I can't figure out what is causing them. One user is local and two are remote ...
1
vote
1answer
420 views

How is it that tools like Hashcat, JTR able to bruteforce an NTLMv2 hashes?

With regards to the following question about the feasibility of (brute|dictionary|rainbowtable)-forcing an NTLMv2 hash: How feasible is it for an attacker to brute-force an NTLMv2 response captured ...
0
votes
1answer
77 views

Database logs have multiple “Logon Login failed for user” from different IPs

Background: I have an SQL Server database running on Amazon RDS The AWS dashboard has a section for logs and whenever I check the logs I see the following: 2018-04-27 06:10:26.00 Logon Error: 18456,...
2
votes
1answer
141 views

Hydra - all passwords work

I want to test some mechanisms of my website when the password of a single user is entered a lot of times in a short time incorrectly in the login form. Therefore I got Hydra (for windows) on GitHub. ...
5
votes
2answers
4k views

How long would it take to brute force an 11 character single-case alphanumeric password?

My previous home wifi router's WPA2 password was permanently fixed to FZ4HBCKHGC8. How long would it take to crack via brute force? Or more pragmatically: How long would it take to exhaust all ...
5
votes
2answers
312 views

Avoid being hacked with brute-force attack

During the last week, our company website has been under a weird brute-force, this attack actually led to hacking an admin account. Our website is a wordpress site. The attacker keeps performing POST ...
0
votes
2answers
1k views

Hydra fails with “[ERROR] target ssh://192.168.16.128:22/ does not support password authentication.”?

I've updated Kali 2.0 to newest version - it is installed using VMWare. Now, every time I use hydra to brute-force SSH, I get the following error: [ERROR] target ssh://192.168.16.128:22/ does not ...