Questions tagged [brute-force]
An attack using every possible input to attempt to produce the correct output. Typically the method of last resort when no weakness allows the use of a more restricted input set. E.g. trying all possible (or likely) passwords, in an attempt to guess the correct one.
777
questions
0
votes
0
answers
21
views
Retrieve TOTP seed from tokens and timestamps [duplicate]
I recently switched to or added the option to use time-based one time passwords, TOTP, as the second factor for some services I use. It got me wondering if it's possible to retrieve the secret seed if ...
- 402
-2
votes
1
answer
92
views
Is it possible to bruteforce SHA256? [duplicate]
SHA256, 64 characters using only 0-9 or lowercase a-f
Making 1.15792089E+77 total possible combinations. Is it possible to crack the input for its given hash?
- 1
1
vote
0
answers
135
views
How to crack KeePass database when knowing the first part of the master password [duplicate]
I have a KeePass 2.47 database which is protected with a master password and a key file.
I managed to lose the 2nd part of my master password. So, I have access to the database, the key file and the ...
- 111
0
votes
1
answer
162
views
What's stopping attackers from brute forcing SSH passwords over new sessions?
I know that when you attempt to log in to a device via SSH, upon inputting an incorrect password, you must wait several seconds before you get another attempt. This is obviously a deterrent against ...
- 246
0
votes
1
answer
201
views
LUKS brute force risk?
If a person finds an old hard drive that was partially overwritten and let's say 1GB of that wasn't and was formerly used for part of a LUKS encrypted partition, what is the risk that such data, which ...
- 1
0
votes
0
answers
59
views
Brute force copy of PKI root certificates
If an attacker wants to create a phishing website with a fake TLS certificate, to my noob mind, there is a way to do this:
Create the fake website certificate
Create the hash for this certificate
...
- 51
0
votes
1
answer
3k
views
Why hydra showing this error [ERROR] could not connect to ssh://192.168.0.1:22?
I am using hydra to bruteforce my router admin page. By scanning with nmap it is showing port 22 ssh is open and when i use medusa it is bruteforcing properly but with hydra i am using this command :
...
- 1
1
vote
0
answers
711
views
Hydra brute force ssh usernames with given RSA key
On a machine supporting ssh, an RSA key is given but no username.
My idea was brute-forcing the SSH username with Hydra but I didn't find any option to give the RSA key to Hydra.
Is it possible to ...
- 937
1
vote
1
answer
73
views
Unlisted directory discovery of a web server without using bruteforce attacks
Some creator I support on SubscribeStar hosts their files on a dedicated AWS web storage server of theirs and the names are easily accessible and sometimes guessable without any kind of security or ...
- 111
2
votes
1
answer
1k
views
Why does Hydra SMB attack not work while Metasploit does?
I'm learning about password attacks, and doing TryHackMe labs.
User: penny
Pass: leo1234
When using Hydra to find the password for the SMB user, I get no valid results:
I know the valid password is ...
- 23
0
votes
0
answers
6
views
Server directory bruteforcing [duplicate]
Recently I saw hundreds of strange requests from different ip addresses in my server logs.
These requests were trying to bruteforce directories for example:
GET /admin/admin.php 404
GET /admin/...
- 1
-1
votes
1
answer
236
views
Why I can´t access my -u and -s flag in Gobuster [closed]
I was trying to use the gobuster tool but I came across this error that I can't find an answer no matter how much I search. How am I supposed to be able to use these two flags with gobuster?
──(kali㉿...
0
votes
1
answer
313
views
How long would this take to bruteforce?
I am working on the following war game from Defend The Web, which requires me to do a source code review to login as the user memtash. The code is on GitLab here.
Having inspected the source code ...
- 715
0
votes
0
answers
11
views
problem with hydra failed message [duplicate]
I'm testing brute force with hydra but my failed message contains ":" and it is giving me an error:
attacking http-post-form://testfire.net:80/login.jsp:uid=^USER^&passw=^PASS^&...
- 1
0
votes
1
answer
52
views
Does this implementation of 2FA expose valid credentials?
I have come across scenarios where a website would send OTP once a user has supplied valid username/password. A confirmation dialog e.g. An OTP has been sent to your registered mobile number would be ...
- 195
5
votes
5
answers
5k
views
Randomly generated secrets: encoding the random bytes in base64 vs keeping them
Today this came to my attention.
When generating random secrets for e.g. JWT (in node.js the most common way is using the crypto.randomBytes() method), I have noticed a lot of people save these tokens ...
- 169
1
vote
1
answer
865
views
Brute-Forcing DVWA login page with hydra - csrf incorrect
I'm learning how to use hydra, but I found a problem.
When I run the following script, I get a CSRF token error. Apparently, the problem is that the token received in CURL is different from the one in ...
- 13
0
votes
1
answer
825
views
John The Ripper succedeed in finding password without printing it
Some days ago I tried to found the password of a file encrypted with AxCrypt 1.x.
I tried John The Ripper and HashCat, but for unknown reason with the last one I failed, and I will open a new thread ...
user285664
3
votes
2
answers
528
views
Brute forcing lost password for PGP encrypted file (symmetric)
I have a file I encrypted with PGP in 2003. It contains some personal data I'd like to regain access to. I have vague idea of the password, but not enough to successfully guess; but I know its ...
- 31
1
vote
0
answers
138
views
"john --format=axcrypt" is not returning results
I would like to open a mysterious old file that I found on my Hard Disk, the contents of which I do not know nor can I guess from its name (PB-mp4-rar.axx).
The file was password-protected with the ...
user285664
4
votes
1
answer
813
views
Is brute force for SSH similar to cracking WPA2 handshake?
I heard recently that WPA2 passwords can be brute forced if somebody captures handshake (which is not very difficult). Can somebody tell if a similar method exists for cracking SSH traffic? I mean ...
- 143
1
vote
1
answer
171
views
Is it secure to expose a salted bcrypt hash IF it is maximum length random secure password?
Is it secure to expose a salted bcrypt hash (minimum 14 cost) if the used password is 72 characters (maximum) byte long, randomly generated letters, numbers, and special characters using secure ...
- 13
2
votes
3
answers
211
views
Best way to bruteforce a list of hashed integers?
I have a list of hashes, I need to find the original value of any of them.
So far I know that the hashes are only numbers of length 30. The format should be something like ...
- 23
2
votes
0
answers
71
views
How to configure Windows Server 2012 Firewall to block this bot attack?
My Windows logs are flooded with what looks like a brute force attack on my machine. I want to be able to block these ports from the outside, but I'm not certain what service this is and what port ...
- 121
1
vote
0
answers
95
views
How to limit number strings with crunch
I'm currently trying to generate a very specific word list. The words generated should go like this:
crunch 9 9 -t @%%%%%%,,-o test.txt
But one of the constraints that I have given myself is that the ...
- 11
1
vote
0
answers
538
views
Brute forcing the brute force page on DVWA v1.0.7 using hydra
I am trying to brute force the brute force log-in page on DVWA v1.0.7 (/dvwa/vulnerabilities/brute/)
I have been working on this for quite some time but I keep getting a bunch of false positives when ...
- 11
0
votes
0
answers
711
views
Hydra and Telnet bruteforcing
To preface this I have full permission to do anything I want to any service I can find on this network as it's part of a course I'm doing in Ethical Hacking. I also want to mention that I'm quite the ...
0
votes
0
answers
76
views
Brute force prevention and alike with stateless API architecture
What are the patterns (best practices, whatever) to prevent brute force (and features alike) in stateless API architectures that keep the system stateless? Couldn't find anything regarding this topic.
...
0
votes
0
answers
620
views
Hydra brute force not working for web app, but the correct password is in the list
I'm trying to brute force an Instagram account I created to play with Hydra. I ran the following command:
Even though the correct password is in the list, it didn't work. This is the output I get:
...
- 1
0
votes
4
answers
459
views
Benefits of non-standard SSH port when password authentication is turned off
Is there any benefit of using a non-standard SSH port when PasswordAuthentication is turned off in sshd?
The only benefit of non-standard SSH ports I know of is a reduction of the amount of brute ...
- 101
0
votes
1
answer
42
views
Do I need to set up super global SESSION for a web form?
I am building a web form in PHP, is just for the user to request information about my services or send comments, so I don‘t need the user to be logged with a username and a password, no databse. I ...
- 1
0
votes
2
answers
2k
views
Fastest way to brute force SSH
I'm doing a CTF on vulnhub and I need to brute force SSH. I've got 6 usernames and 15.000.000 passwords to try so I'm brute-forcing with hydra by running
hydra -L users.txt -P $LIST/rockyou.txt -t 64 -...
0
votes
1
answer
249
views
How to bypass XMLRPC lockout policy?
I'm trying to pentest a Wordpress box that has the XMLRPC endpoint enabled, but it seems to have additional security measures in place that institute IP-based lockout for 24 hours after one failed ...
- 143
3
votes
3
answers
11k
views
Crack JWT HS256 with hashcat
Is it possible to crack a JSON Web Token (JWT) using HS-256 algorithm with hashcat on a normal PC?
hashcat password.txt -m 16500 -a3
How can I calculate how much time it will take?
JWT first section ...
- 33
0
votes
0
answers
61
views
bruteforce attack inside iFrame
How can I change the value of src parameter inside the iFrame tag with programs like wfuzz or fuff?
For example I have an iFrame on the server like this:
iframe.php
<html>
<head><title&...
- 241
1
vote
1
answer
252
views
I am still receiving ssh-bruteforce on my VPS
I have a server in Oracle Cloud Infrastructure Ashburn. I am using Tailscale to SSH my servers and closed Port 22 in public.
I closed Port 22 on the VCN and left Port 22 open on the server. But no one ...
- 37
0
votes
0
answers
15
views
Can anyone help finding what's shady things are logged on my nginx webserver? [duplicate]
I have a hosted a simple react website(testing) with nginx webserver and cloudflare as ssl provider.My website is down from few days with cloudflare error 525 "SSL handshake failed".I was ...
0
votes
1
answer
203
views
How to Find Encryption when knowing Input Plain Text and Output Encrypted Text? [duplicate]
When I submit an Customer Reference ID in an Android Application it POSTs an Encrypted String to an API Endpoint.
For example, if I enter the following CR ID :
"CR-13261150"
it POSTs the ...
0
votes
1
answer
770
views
Hashcat brute force - markov chains
Hashcat uses Markov chains by default when using brute force mode. Do they really speed up the cracking since a randomly generated password normally has the same probability for every combination?
- 937
0
votes
0
answers
98
views
Bruteforce on RDP [duplicate]
I have an internet-facing RDP server and getting constant brute force attacks trying random usernames and passwords. It's Windows 2016 with remote desktop services enabled. What can I do to stop this ...
- 1
1
vote
2
answers
157
views
Design for deleting users accounts, yet knowing when they register again
My webapp takes in email addresses as user names at registration, verifies ownership by sending emails with confirmation links, etc.
I'm now looking for a secure design of a user deletion feature, ...
- 373
-2
votes
2
answers
2k
views
How to Find Encryption Type by Seeing Encrypted Text? [closed]
When I submit an Customer Reference ID in an Android Application it POSTs an Encrypted String to an API Endpoint.
For example, if I enter the following CR ID :
"CR-13261150"
it POSTs the ...
- 7
0
votes
1
answer
886
views
Brute force alphanumeric passwords between 1 to 7 characters long with ZAP
In BurpSuite, you can brute force a password of any length and any character set (in my case, alphanumeric passwords between 1 to 7 characters long). How does one do it in OWASP ZAP, without actually ...
- 3
0
votes
0
answers
62
views
Which password is more secure? [duplicate]
Which password is harder to guess/brute-force:
onlysmallletters!
Ez65);k
And also, can you explain your answer?
- 101
1
vote
1
answer
142
views
Does MacOS Filevault + Mac hardware obviate lengthy login passwords?
Take the combination of an encrypted disk with a secure enclave chip that never exposes an internal Key Encryption Key and throttles or prevents too many password guesses.
Seems to me that this should ...
- 11
0
votes
0
answers
118
views
Allow for login through Tor while preventing brute force/distributed password attacks?
I am making a website with the goal of blocking bots that are trying to login from different IP addresses constantly... while still allowing regular users to login via Tor.
One of the approaches to ...
1
vote
1
answer
151
views
Array of passwords in authentication api
I'm doing security labs on portswigger.net. One of the labs asks to avoid authentication. Intercepting the api call I see that payload for authentication is small json:
{
"username": "...
- 115
24
votes
7
answers
11k
views
After a password leak, is there a Levenshtein distance from which one a newly derivated password can be considered safe?
After a password leak, is there a Levenshtein distance from which one a newly derivated password can be considered safe?
I assume yes, given that if e.g. the word was "password", and the new ...
- 442
1
vote
0
answers
404
views
How many random characters must an unguessable string contain?
I want to add a suffix to my URLs that makes them distinctive and therefore only findable by a person who knows that suffix. I considered using a UUID or hash, but these are usually very long. However,...
- 127
-1
votes
2
answers
1k
views
What does it take to brute force 42 hex characters [closed]
What does it take to brute force something like this
00f54a5851e9372b87810a8e60cdd2e7cfd80b6e31
I can brute force anything else like
iambad, blackapple1, etc
But how can I brute force something like ...
- 17