Questions tagged [brute-force]

An attack using every possible input to attempt to produce the correct output. Typically the method of last resort when no weakness allows the use of a more restricted input set. E.g. trying all possible (or likely) passwords, in an attempt to guess the correct one.

Filter by
Sorted by
Tagged with
0
votes
0answers
26 views

Is there a tool to log in to multiple sites with the same email and password? [closed]

I'm trying to find a tool which can log in to multiple sites (Apple, Gmail, Facebook, Twitter, etc.) with the same username/email and password
2
votes
3answers
279 views

What password length is sufficient in 2020?

What the title says: Assume Alphanumeric characters. Some years back I vaguely remember that 8 characters was not really sufficient protection against brute-force, but any more characters it got to a ...
0
votes
2answers
82 views

password brute force over ssh? (not on ssh)

Can Hydra ssh to remote host and attempt a password list against su root? I am trying to recover the root password to an old device. It is an old Apple jailbroken Apple device, running IOS8. The ...
0
votes
1answer
47 views

Locking accounts using the same strong hash in the database

A website has some bruteforce prevention for logins, and I need to turn that off because it's buggy and it's causing problems. It will stay turned off, probably forever, because there are no plans to ...
0
votes
2answers
108 views

How do I brute-force a password when I know the format? [closed]

The format is 1 letter + 5 numbers (e.g. A12345). Any method and software?
0
votes
1answer
102 views

It seems that someone has been trying to brute force into my hotmail (outlook) e-mail account for years now, what can I do about it?

Every time I go check my account's activity I see something very weird and worrying: multiple attempts to log in to my account, anywhere from 1 to 3 daily attempts. This has been going on for years. ...
-1
votes
1answer
95 views

How do hackers acquire large pools of ip addresses to use? [closed]

I've tried googling but can't find a satisfactory answer. Probably looking up the wrong search terms... I see questions on here and other forums that state they have a sophisticated attacker utilizing ...
0
votes
3answers
82 views

How does memory-hard hashing passwords protect against brute force attacks?

I have a background in web app development and I'm trying to up my security game but there are some things that I find confusing. Like how does memory-hard hashed passwords protect against brute force ...
5
votes
2answers
1k views

Does brute-force time depend on the length of a password only? [duplicate]

If a password is +30 characters long but contains words from the dictionary, is it less secure than a 10-character password that is !@#$#%$^%$, for example?
1
vote
1answer
51 views

TOTP - Larger Timesteps

I'm in the process of implementing TOTP based on RFC6238. The RFC's recommend time step is 30 seconds. However, for addressing a resynchronization problem that we have, if I use a larger time step, ...
0
votes
1answer
51 views

How is SIM blocking enforced?

The only protection features that mobile phones have to keep thieves that stole a target's device from impersonating that subscriber is the PIN/PUK system that's on by default on most SIM cards. The ...
1
vote
0answers
33 views

OWASP ZAP bruteforce 3 parameters Request from 3 payloads (parallel)

How I can fuzz a request with 3 parameters (locations) and 3 payloads: request1 => parameter1=payload1.1; parameter2=payload2.1; parameter3=payload3.1; request2 => ...
0
votes
1answer
68 views

Security of PHP's str_shuffle()

I'm doing some research on PHP's str_shuffle function, I already asked this question multiply times on StackOverflow but got no answer https://stackoverflow.com/questions/61968859/is-it-possible-to-...
1
vote
1answer
114 views

Chance of guessing any valid credit card data

What's the chance of guessing valid credit card data that could be used to make a payment online? To me, it looks like it's not extremely hard to guess, but I'm not able to calculate the probability. ...
0
votes
1answer
60 views

Hydra brute-force login with a timestamp

I am attempting to run a brute-force attack on my router just as a proof of concept and have hit a problem in that the POST request requires a parameter of the current timestamp. Here is my current ...
2
votes
1answer
84 views

How does Amazon secure its 6 digit one-time password?

I noticed that Amazon's password reset relies on a 6 digit numeric PIN. Doesn't this reduce every user's account to a 1 in 10^5~ chance of being accessed through brute force guess factoring in a few ...
0
votes
0answers
48 views

Why can't Hash Suite list the username/hash pairs in my SAM file?

I recently started experimenting with Hash Suite Pro (v3.5.1). This is a Windows program that tests the security of password hashes. A problem that I'm already running into is that Hash Suite is ...
0
votes
1answer
21 views

wfuzz default number of connects in parallel per target?

In Hydra, default number of connects in parallel per target is 16 and it can be changed with -t flag. E.g. -t 100 for 100 connection in parallel per target. wolf@linux:~$ hydra -h | grep parallel -...
0
votes
0answers
108 views

wfuzz show --hs responses when it should hide it

Test site: http://testfire.net/login.jsp Error when login failed: Login Failed: We're sorry, but this username or password was not found in our system. Please try again. Web Form <form action="...
3
votes
2answers
86 views

Is single iteration SHA-256 safe enough for hashing 128bit random number API keys?

I implemented this kind of authentication for my REST API, is this secure and is my logic sound? I am primarily curious about the SHA-256 hash & iterations = 1 aspect. I have omitted some details ...
0
votes
1answer
63 views

how do i find the number of possible keys / password to decrypt a plain text

i like to know if there is any way to decrypt a plain-text that is encrypted 55 rounds using Caesar ciphers with different key for each round. and using brute force attack without knowing the length ...
2
votes
2answers
407 views

Is it feasible to recover a zip file password consisting of about 16 digits?

A friend of mine lost the password of a zip file of her. She remembers that the password contains digits only (that is, only 0, 1, 2, 3, 4, 5, 6, 7, 8, and 9) and is 16 characters long or so. The ...
0
votes
1answer
192 views

Is it possible to guess cvv code from payment number and expiration dates?

If I am not wrong, visa is easy to guess cvv right? Let's say if I have 100,000 credit card numbers and expiration dates, it is possible to make daily 5 guesses. All cards with 5 the same gateway/...
0
votes
0answers
240 views

Difference between gobuster and dirbuster in performance

The only difference I am aware, is of CLI vs GUI. But I am curious to know as to what is the difference in their performance and what are the additional features in one tool compared to another?
1
vote
0answers
67 views

Why does THC Hydra and Medusa give false positives when used on TP-Link Netcam?

One of the tests I carried out was brute-forcing. I already knew what the username and password was for a factory reset IP Netcam but wanted to see how it would work in practice and if it even worked ...
0
votes
1answer
79 views

Getting encrypted password

I have seen many hackers bruteforce password for gaining access to social media. In famous Mr Robot series it is shown that Elliot(main character) brute forces people and the password is displayed on ...
0
votes
1answer
132 views

Bruteforce all IP addresses on network with Hydra

I have been tasked to pen test a computer on my network. I have done some social engineering to get the username and password of the device, and I know ssh is open on the computer. However, I do not ...
1
vote
4answers
121 views

Prevent subscription ID guessing

I am working on a service which offers information on the road traffic situation. Users can subscribe to the service via an API, indicating the area and road classes they are interested in, and are ...
67
votes
4answers
14k views

How did the brute-forcers get my IP address so quickly?

This is probably a massive noob question, but Google results aren’t being helpful and I couldn’t find something specific here. I made this server that just hosts IRC, HTTP and SSH for some friends. I ...
0
votes
1answer
110 views

How does winrar know I typed the right key?

As far as I know WinRar uses the password you type and derives the key from it. But how exactly does it check if the key I typed is correct? What I think is that it compares your guess with the right ...
1
vote
1answer
75 views

How can one mitigate both account-level DOS attacks and online brute force attacks at the same time?

I was recently reading this question, where the accepted answer claims that it is easy for attackers to bypass rate limiting that is based on IP, which makes any sort of IP rate limiting to prevent a ...
0
votes
0answers
14 views

Tool to try and brute force decrypt a string by trying common algorithms? [duplicate]

I've got a string that I believe is encoded with a rather basic algorithm, but rather than trying them all 1 by 1 I'm wondering if there's a tool/website that can attempt to decode it using multiple ...
0
votes
0answers
165 views

Hydra Brute-force attack on Gitlab doesn't work!

I'm using hydra to test my organization's security since our GitLab is accessible online, I wanted to make sure the security of the login itself before implementing other types of security measure (e....
0
votes
0answers
76 views

Bruteforce different encodings

I have a hash $office$*2013*100000*256*16*664f9e0787392c2b1632d3947aaadee4*27dc7d029f76244a407acf9b5afa3740*ebbc055ae08124f6a6be81ef812da4fece16b2ad86eede3916d9cda15f71833f password: лl My wordlist:...
1
vote
0answers
21 views

Name of 'smart brute force' attack against sequential cipher lock [duplicate]

I remember learning about an attack against sequential cipher locks - ones that don't have a 'reset' or 'enter', you just enter digits and as soon as the last n consecutive entries match, the lock ...
0
votes
0answers
43 views

Preventing automated attacks on Tokens without relying on Firewall or Network Infrastructure

Our concern is more on application side prevention automated attacks. Although the firewall does it part to help prevent this, it has been mandated in our development team's security practices that we ...
34
votes
5answers
7k views

Does it matter if a brute force search for a password returns a collision and not the password?

Assume the following very basic hashing algorithm. h(k) = k mod 17 Let's say we create a password 12345 for a website that uses this very basic hashing algorithm. That would yield the hash of 3. ...
0
votes
1answer
146 views

Using Patator ssh_login module how can I get the output to show only on success

I have the following command: patator ssh_login host=<ip> port=<port> user=<user> password=FILE0 0=<path to pwdlist> I would like to output the success result only and not ...
3
votes
2answers
129 views

Solution for password spraying on my app

We have a web application where the input fields for login are: username and password. In order to prevent brute force attacks, we have implemented a lockout function for 5 invalid tries of valid ...
-1
votes
1answer
70 views

find out unprotected commonly used subdirectories

I try to solve a pentesting challenge where I have to find out a directory, which is unprotected from directory listing. I tried to find it with wfuzz -c -z file,'wordlist.txt' --hc 404 http://...
2
votes
2answers
907 views

dictionary attack hashing algorithm

Does the kind of algorithm used to hash passwords have any advantages or disadvantages in a dictionary attack? i.e. SHA256, MD5, etc. or is it just the dictionary that is used by the attacker matters? ...
1
vote
1answer
422 views

Hydra hangs after attempts or returns all passwords valid

I'm using the Hydra tool on Kali Linux 2020.1 and I'm trying to brute force a login at hack.me http://s123056-104737-qer.sipontum.hack.me/login.php. My problem is that whenever I run Hydra it gets ...
-3
votes
1answer
158 views

Bruteforcing a Wi-FI password [closed]

Is it possible to brute-force a WiFi password, since technically there are no limits with login attempts? If there is any, the MAC address of the attacker device can be changed.
0
votes
1answer
80 views

Account lockout for inexistant accounts

I am starting to implement an exponential backoff system to lockout accounts after a certain amount of failed attempts (1min after 5 fails, 2min after 10 fails, etc.). However, as this source suggests,...
0
votes
1answer
100 views

Can bruteforce attacks be prevented with tables of valid inputs?

Can this method of encryption prevent bruteforce attacks? If I had a hypothetical table (or function) where every grammatically valid sentence (limited to some number of words) was given an ...
2
votes
1answer
205 views

Hydra HTTP Form Post with parameters containing a colon “:”

I'm trying to brute force login on my domain using THC Hydra v9.1-dev. It is using an ASP.net form and some of the required post body parameters contain a colon : in them which is the separator used ...
2
votes
1answer
224 views

Is better to have as password a sentence or first letter of the sentence?

Which is better master KeePass password to prevent any type of bruteforce between theses two type of password : Complete sentence invented by user like : I like cheeseburger, tomatoes and fries ! :) ...
0
votes
1answer
433 views

How to prevent Directory Enumeration Attacks (DirB or Directory Buster)

I am dabbling in pen testing (OWASP Juice Shop) and I realized many web application attacks start from enumeration where the attacker uses DirB to find vulnerable Web Objects or Directories to attack ...
0
votes
0answers
48 views

Is using “Signature Versioning” in Amazon S3 a secure way of selling ebooks?

I own an ecommerce platform that sells large (500 megabyte+) ebooks. To reduce server costs I am looking at hosting the ebooks on S3 and using Sendowl/ FetchApp to create the links to the downloads. ...
-1
votes
2answers
173 views

How secure is a 4 digit numbers only captcha? [closed]

How secure is a 4 digit numbers only captcha? How many tries will take to be able to bruteforce that captcha?

1
2 3 4 5
14