Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [brute-force]

An attack using every possible input to attempt to produce the correct output. Typically the method of last resort when no weakness allows the use of a more restricted input set. E.g. trying all possible (or likely) passwords, in an attempt to guess the correct one.

3
votes
1answer
78 views

Why does Authenticated Encryption not decrease confidentiality?

Recently, another question here made me start thinking about authenticated encryption. In my understanding AE allows to check whether a key is valid for decryption without even decrypting the ...
1
vote
2answers
100 views

Bruteforce Veracrypt

I forgot my Veracrypt password, I have around 1000-2000 possible password combination and I need a software to bruteforce the password on Windows. What software would that be?
0
votes
1answer
44 views

Please may I know why I am getting this Sshd log

why I am getting this sshd log Feb 1 13:07:57 sshd[6453]: Failed password for root from 193.34.22.63 port 28980 ssh2 Feb 1 13:08:26 sshd[6897]: Failed password for root from 91.205.189.15 port 48155 ...
0
votes
1answer
47 views

How to create combinations of a password [duplicate]

I don't remember my password, I can't remember exactly the variation. How can I brute force all the permutations of a word knowing the following conditions: Idea of the word (in my mind). Lower and/...
0
votes
3answers
217 views

How often do brute force attacks find the password or key in a much shorter amount of time than the theoretical max?

For a 128-bit key, it would theoretically take many years and a percentage of the entire worlds power output to check every possible key, or for 256-bit it would take 3 sexdecillion years. But the ...
0
votes
1answer
69 views

Using THC Hydra to attack Cisco router

I am trying to do successfull attack on my cisco home router using THC Hydra. I already know a username/password(admin/admin). First with nmap I looked for open ports on router and only opened one ...
0
votes
0answers
72 views

What are the common features to identify Brute-Force attack from Apache log file?

There are various methods to find attack patterns for different types of attacks. Apache-scalp is one such tool, but the rule set is not available to find the brute-force attack pattern via regular ...
0
votes
1answer
43 views

Program for guessing a url [duplicate]

I had an old soundcloud account where i privated one of my songs. After many years, I would like to listen to the track, but i don't remember what email was linked to the account or the password. All ...
0
votes
1answer
74 views

Windows server 2016 Remote Desktop username leaked

One of our servers got infected with ransomware last week (Matrix, .Grhan). The server allowed remote desktop connection from outside on the default port, which was a big security hole (and also, the ...
0
votes
0answers
55 views

Can a smartphone's PIN or password be brute-forced in an offline attack?

I know of exhaustive offline dictionary and brute-force attacks against any given online account, but can the same method be applied against phones, either Android/iPhones? Or would any such attack be ...
0
votes
1answer
46 views

Convert ivs file to hccapx?

I have a ivs and a hccap file. Is there any way to get a hccapx file from them? It can include 2 steps e.g. ivs to cap file and then cap to hccapx. Unfortunately hashcat is not accepting hccap file ...
0
votes
1answer
72 views

How do these attackers find my IP? [duplicate]

Recently, I have been reading a lot of my ubuntu log files (in /var/log/auth.log), and I can see that some IP addresses are actually trying to 'brute-force' their ways into my VM using SSH by testing ...
2
votes
3answers
106 views

Encryption Key vs. One-Time Pad Brute Force

How does an attacker know when they've cracked a traditional encryption key? Wikipedia describes the one-time pad: A 140 character one-time-pad-encoded string subjected to a brute-force attack ...
-3
votes
1answer
107 views

How long would it take to brute force a URL path that's 5 characters long

example.com/[a-zA-Z0-9] the code can be any mix of numbers + uppercase/lowercase letters and it's 5 characters. How long would it take to brute force or is there an easier/faster way to do it?
0
votes
0answers
36 views

Generate a wordlist with strings that have no repeated characters [duplicate]

I am attempting to do this with crunch, but any method would be fine. I want to generate combinations of 6 characters in which no character is repeated. Note that I don't mean the -d function, as that ...
0
votes
0answers
45 views

How to generate a bruteforce list? [duplicate]

I need a rather long dictionary to bruteforce with, following a specific pattern: I need it to combine words using the dictionary, to up to three words. It wouldn't be case sensitive, and it would use ...
0
votes
1answer
78 views

Using hashcat for collision attack [closed]

Whenever i tried generate √N randomly(possible combinations of password length), i always find few collisons of the hash password no matter the length, if the password was made of entirely random ...
2
votes
1answer
153 views

What is the fastest way to brute force a hardware code

Where I live, there is a keypad with numbers from 0 to 9 and two letters, A and B. Using it I noticed that the code was checked on the last 5 things entered. If I were to try every code on the keypad,...
0
votes
0answers
101 views

How is a birthday attack actually performed?

I thought I understood the birthday attack until I tried to actually implement it. Either I'm implementing it wrong, or there's something wrong with my interpretation of the resulting probabilities. ...
0
votes
1answer
66 views

Question about brute force performance

I just make an SHA512 brute force programs that can do 5MH/s on my i5 3.5Ghz (4 cores) which manage to use all CPU resources. If I run the program on a 2PFLOPS hpc , How many hash can it generate per ...
0
votes
0answers
77 views

Brute forcing the Veracrypt header with THC Hydra

I was advised to brute force the Veracrypt header with THC Hydra/Cygwin, but I don't know how to do that. Any help would be appreciated.
1
vote
1answer
85 views

Partially forgotten encryption password for Windows users [duplicate]

I encrypted important files with Veracrypt and I remember most of the password but some parts are forgotten. I need some advice as to what would be the most efficient way of getting the encryption ...
0
votes
1answer
120 views

Brute force MD5 with a prefix and suffix up to n characters/words

I have a couple of things I would like to explore with hashcat. I have a MD5 hashed password, which I know for a fact has a prefix and a suffix. The actual password is located in the middle of the ...
-1
votes
1answer
71 views

Should I blacklist countries to stop brute force attacks?

I'm getting attacks at wp-admin from numerous countries and IPs. When I get a notification from Wordfence that there has been an attack, I blacklist the originating country from the WP backend. Then I ...
0
votes
1answer
97 views

I think my raspberry was hacked, what should I do? [duplicate]

First of all, sorry if all of this seems a bit stupid, but my field of expertise is software development, not security. So, here is what happened. 1/ The breach I did something I really shouldn't ...
2
votes
1answer
69 views

Are there any known collisions of a “long” (64 bit) OpenPGP key ID?

We know that the "short" 32 bit OpenPGP key IDs can be easily brute-forced and the recommendation is to use the "long" 64 bit IDs or full 160 bit SHA1 fingerprint. However I am concerned that the "...
2
votes
1answer
125 views

Partially forgotten encryption password

I encrypted important files with Veracrypt and I remember most of the password but some parts are forgotten. I need some advice as to what would be the most efficient way of getting the encryption ...
0
votes
0answers
64 views

What can attackers do to increase the rate of attempts in a brute-force attack as the number of attempts increases?

I am aware of this post (about Moore's Law and brute-force attack). Suppose is the number of brute-force attempts, we have . What I want to ask is the following: suppose an attacker started a brute-...
0
votes
2answers
115 views

Brute-force attack to exe file [closed]

I have an encrypted file and the program.exe through which it was encrypted. When I want decrypt file, I need to know the password with which the file was encrypted. Can you help me some tool for ...
3
votes
2answers
144 views

Is using a phrase from a book as a password such a bad idea

I've been told/seen online that choosing a sentence or a phrase from a book and using it as a password is a bad idea. How is this true? Unless the potential attacker knew which book you used I don't ...
2
votes
2answers
65 views

Account lockout to protect from brute force: doesn't it open up vulnerabilities to DOS attacks? [duplicate]

AFAIK the recommended practice to mitigate brute force attacks is to lock an account down for, say, 15 min (perhaps escalating lockout time if the attack continues afterwards?) after, say, 5 failed ...
2
votes
2answers
128 views

Why is it still necessary to block brute-force attacks when passwords hash verification requires significant work?

For authentication controls, Owasp gives advice to prevent brute-force attacks by locking out account, and I see this kind of advice in several places (blocking by source IP after failed logins, ...
1
vote
1answer
108 views

Hashcat bruteforce define digit range form and to

I know this password is between 90,000,000 and 500,000,000 how can I tell hashcat to bruteforce exactly in that range? I mean starting from 90,000,000 and ending at 500,000,000 I go the password ...
25
votes
6answers
8k views

What would be the key size for a picture used as a key?

I'm working on a cryptosystem that uses colour pictures as keys for encryption. I'm trying to guess what is the key size of my cryptosystem in order to find the feasibility of a brute force attack. My ...
1
vote
1answer
58 views

What are the disadvantages of using Shamir's Secret Sharing to implement a Partial Password scheme?

Suppose I want to implement a partial password scheme, where the user authenticates by using two passwords: one a normal password, the other is partial, where he only needs to type the selected three ...
0
votes
0answers
178 views

How to mask attack a sha256 hash with following information using hashcat?

I am hashcat newbie and I want to crack a hash :) The answer is 1-15 (unknown) characters and it may contain 'a-z' 'A-Z' '0-9' and '_' . (A Twitter username) How may I mask attack a hash with above ...
0
votes
1answer
51 views

NMAP NSE script stopping after 900 seconds (15 minutes)

I am experimenting with ssh bruteforce over my home network using the ssh-brute nse script. I have a short list of usernames (just 12) but a long list of passwords (1M). I can't seem to get the ssh-...
1
vote
1answer
69 views

Manage Logs of Excessive Member and Server Authentication Failures

Currently, in our SIEM environment, we are attempting to reduce noise and any non-actionable items. One of the most frequent items we receive on a weekly basis is a report based on excessive member ...
38
votes
8answers
13k views

Is brute force a probable threat even if you enable CAPTCHA and rate limit logins?

Let's assume CAPTCHA is enabled with account lock out control (after five continuous failed attempts, the account will be locked for 15 min) on a system. Is brute force still a probable threat?
0
votes
1answer
561 views

Brute-Forcing DVWA login page with hydra

I'm learning how to brute force web login pages with a popular brute force tool called "Hydra". I'm using Kali Linux (VirtualBox) to do this. I've installed DVWA (Damn Vulnerable Web Application) and ...
1
vote
1answer
171 views

Are partial passwords a security improvement over full passwords?

With full password authentication, you need to enter the full password every time. With partial password authentication, you're asked for some subset of the password each time, and which characters ...
1
vote
1answer
74 views

Why are SQL servers not attacked as frequently as ssh servers?

I have a server running with both SSH and MySQL accessible to the public internet. Both run on default ports (22 and 3306). The ssh server is attacked by bots all the time. This is the output of ...
1
vote
1answer
117 views

Lost password for encrypted external HD

Have an old filevault encrypted external hard drive. Would like to access but have forgotten the password. However I do remember the style of password (XKCD four word style) and remember two of the ...
1
vote
1answer
106 views

Slow Hashing Without a Salt?

I'm trying to design a security scheme that involves a shared secret but isn't a traditional account password situation. The server would store a set of "keys", each of which has a blob of data ...
1
vote
1answer
214 views

Please explain the vulnerability for the pre-shared Key for IKEv1 brute force IPSec

After the vulnerability was released for IPSec IKEv1 PSKs, our organization decided to increase the size and complexity of the PSK. However, upon releasing the new PSK we had a few issues: ...
0
votes
1answer
86 views

How is my employer accessing my router when employer's laptop is wirelessly connected to my home network

I have a modem bridged to a modern router running open source software and heavily secured. I have all connections to the router through a personal vpn from a dedicated provider. During work from home ...
1
vote
1answer
346 views

hashcat specific brute force

Is this scenario possible: I know the first three letters of the password (exact), i know the password is between 10-14 characters, i know the rest of the characters are "b,t,p,1,3,6,7" which can be ...
1
vote
1answer
1k views

Best tool to BruteForcing RDP

I have tried many tools and to do not seem to be successful with locking out an account I am testing on my network with an RDP domain. I used crowbar, ncrack and THC hydra but they don't seem to be ...
0
votes
1answer
154 views

Protect MySQL against brute-force attacks on dedicated CentOS 7 server

I have a database in a dedicated server (CentOS 7) setup by an external provider. I see a disgusting amount of brute-force attempts in MySQL log file every day. I know the best option would be to not ...
0
votes
1answer
135 views

Are there any good brute force programs in C#? [closed]

I'm planning to research & learn from brute force methods, but all the popular ones I found like John the Ripper or hashcat are written in C & OpenGL which I don't have much knowledge about so ...