Questions tagged [brute-force]

An attack using every possible input to attempt to produce the correct output. Typically the method of last resort when no weakness allows the use of a more restricted input set. E.g. trying all possible (or likely) passwords, in an attempt to guess the correct one.

Filter by
Sorted by
Tagged with
0
votes
0answers
35 views

Is using “Signature Versioning” in Amazon S3 a secure way of selling ebooks?

I own an ecommerce platform that sells large (500 megabyte+) ebooks. To reduce server costs I am looking at hosting the ebooks on S3 and using Sendowl/ FetchApp to create the links to the downloads. ...
-1
votes
2answers
149 views

How secure is a 4 digit numbers only captcha? [closed]

How secure is a 4 digit numbers only captcha? How many tries will take to be able to bruteforce that captcha?
0
votes
0answers
47 views

What would be the algorithm that would be used to Brute Force Blowfish Encryption?

For my science fair project, I will be researching the algorithm for encrypting data using the Blowfish Encryption technique. Suppose I have a word I would like to encrypt using this method called "...
2
votes
1answer
43 views

WEP QOS_DATA vs DATA decryption - difference?

I recently played a bit with my hardware pocket size IV WEP sniffer. It's a 5v tool that i use in my lab when bored: https://www.youtube.com/watch?v=jJyRaWrnbJg In my tests i figured out one of my ...
0
votes
0answers
42 views

Is the WPS implementation for Wifi Direct on Amazon Fire Stick secure?

Specifically: Does the fire-stick use PIN method or push-button method for its Wifi Direct implementation? From my experience using the Fire Stick for mirroring an Android phone, I would guess it is ...
1
vote
0answers
72 views

Blocking URL brute-forcing on my server

Every day my server receives many GET requests in search of security holes. In other words, they are trying a list of words in search of a hole. for example: http://myapp.com/phpmyadmin http://...
1
vote
1answer
77 views

Protect Wordpress against ddos attack [closed]

The above screenshot is from my website's cpanel visitors list.My website is build on wordpress. And I think someone is trying hard to crack open my website with DDOS attack and drain out my 10gb ...
6
votes
1answer
515 views

Securely displaying hidden integers with MD5

A system I'm studying uses the following mechanism: a 19-digit integer is hashed via the MD5 algorithm and the salt of the integer is shown in plain sight to the user before they take an irreversible ...
0
votes
0answers
81 views

Hydra - Brute force command is stalling

Very new to application testing here. I am working through the hacker101 CTF (petshop) examples and I am having problems with brute forcing a username form with Hydra. The error message looks like it ...
0
votes
0answers
51 views

Bruteforce directory with Burp : 2 parameters used in 3 step macro for intruder

I try to bruteforce paths with Burp intruder but to do so I have to be authenticated and have a valid CSRF token (transmitted as a GET parameter). So what I want to do is : Call the login page to ...
2
votes
0answers
62 views

Bruteforce https post using single tcp connection

So I've tried bruteforcing my server using thc-hydra's https-post-form, but it floods the server very quickly and the requests start timing out. However, If I go through the browser where the HTTP ...
0
votes
1answer
37 views

UFW Blocks some IPs which are trying to attempt a connection to the server

UFW‌ Blocks some IPs which are trying to attempt a connection to the server. I checked most blocked IPs in abuseIPD website and all blocked IPs are reported for brute force attack and/Or ssh spamming ...
-1
votes
1answer
150 views

Spider (web scrawling) vs Force Browsing

I'm scanning websites with OWASP ZAP and noticed that the Spider attack and Force Browse attack return somewhat different results. What are the differences between Web Spiders (Web Crawlers) and ...
1
vote
1answer
61 views

Does digested passwords send over a non encrypted channel offers additional security over plain text passwords?

I am learning about WS-Security and trying to compare different options offered by UsernameToken as described in this document. AFAIK, a digested password is a hash of the plain text password along ...
0
votes
0answers
30 views

How hackers bruteforce web logins when password attempts are limited? [duplicate]

I read about password brute force attacks, but I wonder how hackers try this attack when developers limit password attempts.
0
votes
2answers
52 views

Is it safe to implement 15 bytes password reset tokens?

I want to figure out how safe is to implement a 15 bytes long password reset token. If we have 26 letters and 10 numbers, 36 possibilities per byte. And we have a 15 byte long token, that means that ...
2
votes
1answer
202 views

Replace PATH space with random string

I came across http://test.co.uk/img/rOTJwSOqWzHaDsEUcHhI. If we take a look at it the directory space is protected against bruteforcing of the whole directory to explore private images. I don't know ...
0
votes
3answers
167 views

Is an 8 characters long password reset token strong enough?

I am testing a website with a password reset functionality that provides a link with a token like most websites. I asked for multiple password reset links to see any pattern in the tokens. All the ...
0
votes
1answer
82 views

MySQL brute force attempts from localhost

We have a Linux box (Ubuntu VERSION="18.04.2 LTS (Bionic Beaver)" that hosts MySQL. When I check the MySQL logs I see constant failed attempts to log in from root@localhost. does this imply that I ...
2
votes
1answer
237 views

How do attacks on password locked accounts work?

A lot of questions here are about the safety of passwords e.g a Login Password to an account on site X. But how can attackers get in the account when they have to guess the passwords? I know there is ...
0
votes
0answers
139 views

How to make wfuzz perform a request to retrieve CSRF token to include in the main request?

How to make wfuzz perform a request to retrieve CSRF token to include in the main request? I've previously used patator, which includes the options before_url and before_fgrep for performing a ...
13
votes
5answers
8k views

Defense against attacks using dictionaries

Some forms of attacks on passwords use dictionaries. It is safer to use nonsense passwords like YunSUanLin, Artibichoke, etc., which do not seem to pertain to any dictionary?
1
vote
1answer
276 views

How to speed up brute forcing of finding a WEP key from a captured file?

I have been working on decrypting a WEP .cap file using crunch. It has 1268 IVs. I am wondering: Can I get a clue from the captured file to speed the process of brute-forcing? If not, what other ways ...
-4
votes
1answer
99 views

Binary Numbers converted to Hexadecimal private key [closed]

Couldn't you use brute force to guess someone’s binary number because it's 1 or 0 - 256 times then just keep switching 1's and 0's around- which then can be converted hexadecimal to guess their ...
0
votes
0answers
17 views

Password checking implementation: delay on unsuccessful attempts [duplicate]

What would be wrong with the username/password checker where the response is instantaneous for valid attempts but a pre-built time delay (say 1 sec) is used for unsuccessful ones? It would not slow ...
3
votes
1answer
365 views

How secure is KeePass KDBX4 by default?

How secure is KeePass KDBX4 by default if someone obtain the .kdbx file and attempt to brute-force it without knowing any hint of the master password? With assumption : The password length is equal/...
0
votes
1answer
33 views

NCrack bruteforcing for http-get using -iL options

How to do NCrack bruteforcing for http-get service using -iL (mass scan) options where server is having different port.
0
votes
0answers
56 views

Remote Desktop compromised

So roughly 2 weeks ago my Remote Desktop was compromised whilst I was actively interacting with my server via Rdp I was prompted with a disconnect status equal to “ Another user has connected to ...
7
votes
1answer
144 views

TOTP brute force prevention

Lets use Google Authenticator as example. A 6 digit code is generated every 30 second. Each random attempt has 1/1,000,000 chance of success. Server will usually accept code of ±30s which increased ...
1
vote
0answers
109 views

Preventing Linux brute force concurrent su/sudo attempts

Its well known that popular Linux distros use the PAM default to slightly delay incorrect login attempts, thus mitigating brute-force attacks against a user account (for example, running su repeatedly ...
0
votes
0answers
66 views

How long will it take to crack a hashed random string

If I generate 128 bit, 512 bit and 1024 bit random strings using either: A native rand() function (C, PHP, Python, etc) OpenSSL random bytes Hardware generated random number And hash the random ...
2
votes
3answers
134 views

Terminology for reduced brute-force attack?

Many security algorithms today have such a large key length, that there's just no use in trying to brute-force a key. For example to find one AES-256 key you would have to try 2^255 keys on average. ...
0
votes
0answers
28 views

Does the Loginizer WordPress plugin also limit XML-RPC-calls?

I learned about about XML-RPC and specifically XML-RPC in WordPress. Now, the safety of XML-RPC in WordPress this is disputed. But given, that I would like to continue using XML-RPC, in the most save ...
0
votes
0answers
29 views

PEAP MS-CHAPv2 brute force attack

I have a 802.1x switch and a client authenticated using PEAP-MS-CHAPv2. I sniffed the traffic using a HUB between the client and the switch. How can I use the captured informations to perform a brute-...
2
votes
1answer
105 views

Centralized brute force login detection using netflow data

Is brute force login detection feasible with netflow data? With the netflow data one could check the number of incoming packets to a specific destination port (for each flow). If the number is below a ...
1
vote
0answers
62 views

Bruteforcing via port 88 on MacOS

Macos has open port 88 by default. Is it possible to check validity of the password via this port from Linux and how? If the vncserver is active, it is possible to know also the username (by ...
22
votes
2answers
8k views

Do Veracrypt encrypted volumes have any kind of brute force protection?

I have a 10mb encrypted volume which I made with Veracrypt and was planning to upload it to the internet. I have a pretty strong password but was worried about its protection against brute force ...
1
vote
0answers
28 views

How much time is needed for bruteforce kerberos/ntlm?

My question is simply how much time an attacker needs for full bruteforce on typical complexity password policy given either kerberos ticket/ as req or Ntlm transaction. This depends on the ...
3
votes
2answers
182 views

How does Window Hello protect against brute forcing?

With my Windows 10 computer, I have the option to set up a PIN with Windows Hello (I believe it's with that program). My normal Outlook password is 15+ characters mixed with upper case and lower case ...
1
vote
3answers
212 views

Disguising the type of hash used

I've read about why MD5, SHA1, and many other hashing functions are insecure, by a lot, but I'm thinking of doing a different approach. It won't increase security, I'm aware of that, but I believe it ...
9
votes
1answer
3k views

What local resources are used when bruteforcing a remote service?

What pc resources are used when bruteforcing ? I mean bruteforcing something online, not hashes. Do you need a good amount a RAM and a good CPU or it's just about the internet speed ?
1
vote
1answer
85 views

Postfix SMTP - Can I use SSH public keys instead of sasl password

I am relatively new to managing mail server, although i am familiar with webhosting servers not running dedicated email services. Postfix is configured to use sasl-password authentication I have ...
0
votes
1answer
204 views

Limiting the number of duplicate character types in crunch

I'm trying to generate a password list of 10 character passwords containing only a combination of 3 - 6 numbers and 3 - 6 uppercase letters. I see option -d which allows a set limit of duplicates of ...
0
votes
1answer
127 views

Generating passwords with rule: the contents within a 10 characters string must maintain a certain ratio of numbers and letters in no particular order

I'm playing around with Kali and am looking to crack my WPA2 default password. I started generating 10 character passwords with a charset of solely digits and upper alpha lastnight and after 10 mins, ...
1
vote
1answer
83 views

Is there any methods available other than brute force and dictionary attacks?

I am curious to know about the wifi attacks. And I have known a little bit about brute force attack and dictionary attack. Is there any other methods available other than these two...?
0
votes
2answers
441 views

How to brute force only username not password?

I want to find the username first, then pass the username and a password list. I could not find flags to ignore password in Ncrack and other related tools. The device I want to find a username is ...
-1
votes
1answer
197 views

Subdomain scanner without brute-force attack? [duplicate]

It is possible to scan subdomains of network without brute-force attack? If yes, how it works? I tried to scan the network with some penetrating tools and it returned to me subdomain which doesn't ...
1
vote
2answers
303 views

BurpSuite Brute Force Iteration

I am working on a security assessment for an online application. When testing the pin verification mechanism and possibilities of brute force, I came across a post request that looks like the below ...
1
vote
1answer
115 views

Is it possible to prevent WiFi password brute-forcing?

Are there any measures I can set, except using a better password, to prevent someone brute-forcing a WiFi password?
0
votes
0answers
25 views

How secure will it be to use “Google Docs long url” like authentication scheme for orders in my online shop? [duplicate]

For the sake of simplicity, instead of full-fledged authentication with login and password, I want to create "Google Docs long url" authentication scheme for my internet shop for the users. To let ...