Questions tagged [brute-force]

An attack using every possible input to attempt to produce the correct output. Typically the method of last resort when no weakness allows the use of a more restricted input set. E.g. trying all possible (or likely) passwords, in an attempt to guess the correct one.

Filter by
Sorted by
Tagged with
0
votes
0answers
59 views

Isn't this kind of password ultimately secure and insanely easy to remember? [duplicate]

Pick any dictionary word. Think of a number over 10 and below 20. Repeat the word as many times as the number, and end off with the same number (for example, "12"). Example: ...
0
votes
0answers
22 views

Web path scanner evaluation criteria [closed]

I recently find out that when selecting a web path scanner, the following features should be considered, in order of importance. Functionality If you can't get it to run on your system, it's no good ...
-2
votes
1answer
69 views

How to choose a web path scanner?

There are many tools designed to brute force directories and files in webservers, for example: https://tools.kali.org/web-applications/dirbuster https://github.com/maurosoria/dirsearch https://github....
-1
votes
0answers
45 views

Which is the fastest web path scanner? [closed]

There are many tools designed to brute force directories and files in webservers, for example: https://tools.kali.org/web-applications/dirbuster https://github.com/maurosoria/dirsearch https://github....
1
vote
0answers
41 views

Brute force ssh login attempt on AWS t2.micro

I have some confusion in understanding the security groups itself i guess. The login attempts are being made to different ports , here are the logs Jan 08 00:00:13 ip-172-31-10-252 sshd[6067]: ...
1
vote
4answers
755 views

Securely establish and verify PIN over network

Is there a (relatively simple) protocol for setting up a (6-digit) PIN on a remote server, that also prevents those, who may get a DB dump from the server, from brute-forcing that PIN? Is PBKDF2 and ...
32
votes
2answers
5k views

When could 256 bit encryption be brute forced?

Assuming quantum computing continues to improve and continues to perform like this: ... quantum computer completes 2.5-billion-year task in minutes is it reasonable to expect that 256 bit encryption ...
0
votes
0answers
44 views

Avast Remote Access Shield is blocking unknown remote access attempts to my computer (Win10) coming from a MacBook device on my LAN. [Confused]

I need help understanding what is happening on my LAN and determine if a malicious attack is taking place. The "attacks" started to occur for the first time last night. This morning, I open ...
3
votes
1answer
105 views

Credit card form : Is it neccessary to obscure error messages?

I'm working on designing a credit card payment form whose core functionality is provided by a payment processing company ("upstream"). Upon some transaction errors the upstream returns the ...
1
vote
0answers
27 views

Can I read environment process variables of a react client in a browser?

I'm currently doing a pentest for a client and I've come across something new to me. When I log in, I view the username/password values in burpsuite and find they are encrypted using Cryptojs. I'm ...
2
votes
1answer
90 views

Is using Google Forms to share “passcode protected” information safe from brute force attacks?

I have recently seen many people use Google Forms as a way of sharing “passcode protected” information. They seem to have the first section of the form with a required field asking for a short piece ...
0
votes
1answer
84 views

Smaller password lists [closed]

I hack wifi passwords with kali linux on airmon-ng and I make always password lists with crunch but the lists are always too long (I'm talking about <100 PT) and I want to know if is there a ...
3
votes
1answer
247 views

How secure is the getapassphrase.com approach to password generation?

getapassphrase.com is a website that generates passphrases. The user sets a complexity in bits, and the site spits out results like: liberal panda and ill asp decline young suit in Kansas or rowdy ...
12
votes
1answer
4k views

How can I secure MySQL against bruteforce attacks?

I use Fail2ban on a busy Debian-based database server to secure ssh against brute force attacks, but for performance reasons, I don't want to log every connection from the application server (it would ...
0
votes
0answers
38 views

Find configured domains accepted by a reverse proxy

Context I am playing around with a machine from hack the box. I found what appears to be a squid v. 4.6 listening on port 3128. None of my requests works < HTTP/1.1 400 Bad Request < Server: ...
2
votes
2answers
122 views

Is using PBKDF2 good protection against brute-force attacks on web application login pages?

We've recently had a penetration test for one of our applications. The Penetration Testing company identified that our application lacks protections against brute-force attacks on the login page. Ref: ...
1
vote
4answers
99 views

Will brute force attack exhaust web server, resulting in DOS

I do know the difference between brute force attack and DOS. What if a web server doesn't have account lock out in place and a few brute force attacks is being started in parallel, and these attacks ...
0
votes
1answer
84 views

SNMP Enumeration

I'm scanning a machine that has the UDP port 161 open and I'm not able to run snmpwalk against it as I'm returned with the error: Timeout: No Response from <IP> I tried to run the onesixtyone ...
0
votes
1answer
200 views

Brute-Forcing a Chrome Login Data file

Say I have a "Login Data" Chrome file that is encrypted with the user's Windows password. Is there a way I can brute-force the file and try to decrypt it using every password possible?
0
votes
1answer
73 views

routersploit bruteforce cred attcack using http

while i'm trying to do a brutforce attack on my router using routersploit. Im getting the error rsf (HTTP Basic/Digest Bruteforce) > run [*] Running module creds/generic/...
2
votes
3answers
694 views

What password length is sufficient in 2020?

What the title says: Assume Alphanumeric characters. Some years back I vaguely remember that 8 characters was not really sufficient protection against brute-force, but any more characters it got to a ...
0
votes
2answers
117 views

password brute force over ssh? (not on ssh)

Can Hydra ssh to remote host and attempt a password list against su root? I am trying to recover the root password to an old device. It is an old Apple jailbroken Apple device, running IOS8. The ...
0
votes
1answer
48 views

Locking accounts using the same strong hash in the database

A website has some bruteforce prevention for logins, and I need to turn that off because it's buggy and it's causing problems. It will stay turned off, probably forever, because there are no plans to ...
0
votes
2answers
119 views

How do I brute-force a password when I know the format? [closed]

The format is 1 letter + 5 numbers (e.g. A12345). Any method and software?
0
votes
1answer
180 views

It seems that someone has been trying to brute force into my hotmail (outlook) e-mail account for years now, what can I do about it?

Every time I go check my account's activity I see something very weird and worrying: multiple attempts to log in to my account, anywhere from 1 to 3 daily attempts. This has been going on for years. ...
-1
votes
1answer
100 views

How do hackers acquire large pools of ip addresses to use? [closed]

I've tried googling but can't find a satisfactory answer. Probably looking up the wrong search terms... I see questions on here and other forums that state they have a sophisticated attacker utilizing ...
0
votes
3answers
101 views

How does memory-hard hashing passwords protect against brute force attacks?

I have a background in web app development and I'm trying to up my security game but there are some things that I find confusing. Like how does memory-hard hashed passwords protect against brute force ...
5
votes
2answers
2k views

Does brute-force time depend on the length of a password only? [duplicate]

If a password is +30 characters long but contains words from the dictionary, is it less secure than a 10-character password that is !@#$#%$^%$, for example?
1
vote
1answer
60 views

TOTP - Larger Timesteps

I'm in the process of implementing TOTP based on RFC6238. The RFC's recommend time step is 30 seconds. However, for addressing a resynchronization problem that we have, if I use a larger time step, ...
1
vote
1answer
82 views

How is SIM blocking enforced?

The only protection features that mobile phones have to keep thieves that stole a target's device from impersonating that subscriber is the PIN/PUK system that's on by default on most SIM cards. The ...
1
vote
0answers
40 views

OWASP ZAP bruteforce 3 parameters Request from 3 payloads (parallel)

How I can fuzz a request with 3 parameters (locations) and 3 payloads: request1 => parameter1=payload1.1; parameter2=payload2.1; parameter3=payload3.1; request2 => ...
0
votes
1answer
78 views

Security of PHP's str_shuffle()

I'm doing some research on PHP's str_shuffle function, I already asked this question multiply times on StackOverflow but got no answer https://stackoverflow.com/questions/61968859/is-it-possible-to-...
1
vote
1answer
214 views

Chance of guessing any valid credit card data

What's the chance of guessing valid credit card data that could be used to make a payment online? To me, it looks like it's not extremely hard to guess, but I'm not able to calculate the probability. ...
0
votes
1answer
78 views

Hydra brute-force login with a timestamp

I am attempting to run a brute-force attack on my router just as a proof of concept and have hit a problem in that the POST request requires a parameter of the current timestamp. Here is my current ...
2
votes
1answer
153 views

How does Amazon secure its 6 digit one-time password?

I noticed that Amazon's password reset relies on a 6 digit numeric PIN. Doesn't this reduce every user's account to a 1 in 10^5~ chance of being accessed through brute force guess factoring in a few ...
0
votes
0answers
61 views

Why can't Hash Suite list the username/hash pairs in my SAM file?

I recently started experimenting with Hash Suite Pro (v3.5.1). This is a Windows program that tests the security of password hashes. A problem that I'm already running into is that Hash Suite is ...
0
votes
1answer
28 views

wfuzz default number of connects in parallel per target?

In Hydra, default number of connects in parallel per target is 16 and it can be changed with -t flag. E.g. -t 100 for 100 connection in parallel per target. wolf@linux:~$ hydra -h | grep parallel -...
0
votes
0answers
260 views

wfuzz show --hs responses when it should hide it

Test site: http://testfire.net/login.jsp Error when login failed: Login Failed: We're sorry, but this username or password was not found in our system. Please try again. Web Form <form action="...
4
votes
2answers
145 views

Is single iteration SHA-256 safe enough for hashing 128bit random number API keys?

I implemented this kind of authentication for my REST API, is this secure and is my logic sound? I am primarily curious about the SHA-256 hash & iterations = 1 aspect. I have omitted some details ...
0
votes
1answer
88 views

how do i find the number of possible keys / password to decrypt a plain text

i like to know if there is any way to decrypt a plain-text that is encrypted 55 rounds using Caesar ciphers with different key for each round. and using brute force attack without knowing the length ...
2
votes
2answers
879 views

Is it feasible to recover a zip file password consisting of about 16 digits?

A friend of mine lost the password of a zip file of her. She remembers that the password contains digits only (that is, only 0, 1, 2, 3, 4, 5, 6, 7, 8, and 9) and is 16 characters long or so. The ...
0
votes
1answer
869 views

Is it possible to guess cvv code from payment number and expiration dates?

If I am not wrong, visa is easy to guess cvv right? Let's say if I have 100,000 credit card numbers and expiration dates, it is possible to make daily 5 guesses. All cards with 5 the same gateway/...
0
votes
0answers
695 views

Difference between gobuster and dirbuster in performance

The only difference I am aware, is of CLI vs GUI. But I am curious to know as to what is the difference in their performance and what are the additional features in one tool compared to another?
1
vote
0answers
156 views

Why does THC Hydra and Medusa give false positives when used on TP-Link Netcam?

One of the tests I carried out was brute-forcing. I already knew what the username and password was for a factory reset IP Netcam but wanted to see how it would work in practice and if it even worked ...
0
votes
1answer
82 views

Getting encrypted password

I have seen many hackers bruteforce password for gaining access to social media. In famous Mr Robot series it is shown that Elliot(main character) brute forces people and the password is displayed on ...
0
votes
1answer
410 views

Bruteforce all IP addresses on network with Hydra

I have been tasked to pen test a computer on my network. I have done some social engineering to get the username and password of the device, and I know ssh is open on the computer. However, I do not ...
1
vote
4answers
125 views

Prevent subscription ID guessing

I am working on a service which offers information on the road traffic situation. Users can subscribe to the service via an API, indicating the area and road classes they are interested in, and are ...
67
votes
4answers
14k views

How did the brute-forcers get my IP address so quickly?

This is probably a massive noob question, but Google results aren’t being helpful and I couldn’t find something specific here. I made this server that just hosts IRC, HTTP and SSH for some friends. I ...
0
votes
1answer
121 views

How does winrar know I typed the right key?

As far as I know WinRar uses the password you type and derives the key from it. But how exactly does it check if the key I typed is correct? What I think is that it compares your guess with the right ...
1
vote
1answer
76 views

How can one mitigate both account-level DOS attacks and online brute force attacks at the same time?

I was recently reading this question, where the accepted answer claims that it is easy for attackers to bypass rate limiting that is based on IP, which makes any sort of IP rate limiting to prevent a ...

1
2 3 4 5
15