Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [brute-force]

An attack using every possible input to attempt to produce the correct output. Typically the method of last resort when no weakness allows the use of a more restricted input set. E.g. trying all possible (or likely) passwords, in an attempt to guess the correct one.

0
votes
0answers
24 views

PEAP MS-CHAPv2 brute force attack

I have a 802.1x switch and a client authenticated using PEAP-MS-CHAPv2. I sniffed the traffic using a HUB between the client and the switch. How can I use the captured informations to perform a brute-...
1
vote
1answer
71 views

Centralized brute force login detection using netflow data

Is brute force login detection feasible with netflow data? With the netflow data one could check the number of incoming packets to a specific destination port (for each flow). If the number is below a ...
0
votes
0answers
62 views

RAR password (knowing some parts from pass) [closed]

I need your advice in my case: I have a RAR file protected with this password is: ( THE****AHMAD** ) The first word from the password is: THE The second word is contains 4 characters and its maybe ...
1
vote
1answer
2k views

OWASP ZAP bruteforce by password not username

I want to bruteforce a login page using OWASP ZAP, using two separate passwords (90 lines) and username (200 lines) files, with the bruteforce POST requests to be ordered by password like: user001:...
1
vote
0answers
45 views

Bruteforcing via port 88 on MacOS

Macos has open port 88 by default. Is it possible to check validity of the password via this port from Linux and how? If the vncserver is active, it is possible to know also the username (by ...
22
votes
2answers
7k views

Do Veracrypt encrypted volumes have any kind of brute force protection?

I have a 10mb encrypted volume which I made with Veracrypt and was planning to upload it to the internet. I have a pretty strong password but was worried about its protection against brute force ...
0
votes
1answer
182 views

What are the common features to identify Brute-Force attack from Apache log file?

There are various methods to find attack patterns for different types of attacks. Apache-scalp is one such tool, but the rule set is not available to find the brute-force attack pattern via regular ...
1
vote
0answers
26 views

How much time is needed for bruteforce kerberos/ntlm?

My question is simply how much time an attacker needs for full bruteforce on typical complexity password policy given either kerberos ticket/ as req or Ntlm transaction. This depends on the ...
0
votes
1answer
74 views

Limiting the number of duplicate character types in crunch

I'm trying to generate a password list of 10 character passwords containing only a combination of 3 - 6 numbers and 3 - 6 uppercase letters. I see option -d which allows a set limit of duplicates of ...
-1
votes
3answers
6k views

Hydra producing fake login passwords

I'm trying to "hack" (login) into my own HTTPS website account through Hydra. Therefore, it is 100% legal. Hydra keeps producing tons of incorrect passwords. This is the code I use: hydra -v -V -l ...
0
votes
2answers
167 views

How to brute force only username not password?

I want to find the username first, then pass the username and a password list. I could not find flags to ignore password in Ncrack and other related tools. The device I want to find a username is ...
9
votes
1answer
3k views

What local resources are used when bruteforcing a remote service?

What pc resources are used when bruteforcing ? I mean bruteforcing something online, not hashes. Do you need a good amount a RAM and a good CPU or it's just about the internet speed ?
2
votes
2answers
155 views

How does Window Hello protect against brute forcing?

With my Windows 10 computer, I have the option to set up a PIN with Windows Hello (I believe it's with that program). My normal Outlook password is 15+ characters mixed with upper case and lower case ...
1
vote
3answers
186 views

Disguising the type of hash used

I've read about why MD5, SHA1, and many other hashing functions are insecure, by a lot, but I'm thinking of doing a different approach. It won't increase security, I'm aware of that, but I believe it ...
2
votes
1answer
999 views

RSA-1024 vs. DSA-1024: Claim DSA SSH key is much faster to brute force

Does the brute force speed vary significantly between 1024-bit RSA and DSA SSH keys? DSA like gpu keypairs are probably DSA/Elgamal? (Can't find docs) EDIT: The reason I ask is an instructor that "...
0
votes
1answer
90 views

Question about brute force performance

I just make an SHA512 brute force programs that can do 5MH/s on my i5 3.5Ghz (4 cores) which manage to use all CPU resources. If I run the program on a 2PFLOPS hpc , How many hash can it generate per ...
0
votes
1answer
110 views

Generating passwords with rule: the contents within a 10 characters string must maintain a certain ratio of numbers and letters in no particular order

I'm playing around with Kali and am looking to crack my WPA2 default password. I started generating 10 character passwords with a charset of solely digits and upper alpha lastnight and after 10 mins, ...
1
vote
1answer
42 views

Postfix SMTP - Can I use SSH public keys instead of sasl password

I am relatively new to managing mail server, although i am familiar with webhosting servers not running dedicated email services. Postfix is configured to use sasl-password authentication I have ...
130
votes
10answers
257k views

Where can I find good dictionaries for dictionary attacks?

I’m wondering where I can find good collections of dictionaries which can be used for dictionary attacks? I've found some through Google, but I’m interested in hearing about where you get your ...
0
votes
2answers
244 views

Protect MySQL against brute-force attacks on dedicated CentOS 7 server

I have a database in a dedicated server (CentOS 7) setup by an external provider. I see a disgusting amount of brute-force attempts in MySQL log file every day. I know the best option would be to not ...
0
votes
1answer
1k views

Brute-Forcing DVWA login page with hydra

I'm learning how to brute force web login pages with a popular brute force tool called "Hydra". I'm using Kali Linux (VirtualBox) to do this. I've installed DVWA (Damn Vulnerable Web Application) and ...
5
votes
1answer
304 views

Spoofing an NTP server to allow bruteforce on any smartphone

We all know that smartphones (i'll take iPhone as an example) rely on SNTP/NTP servers to update a device's time and date. So, by creating an SNTP server that mimics Apple's server, we can actually ...
2
votes
1answer
271 views

Hydra - all passwords work

I want to test some mechanisms of my website when the password of a single user is entered a lot of times in a short time incorrectly in the login form. Therefore I got Hydra (for windows) on GitHub. ...
0
votes
2answers
3k views

Hydra fails with “[ERROR] target ssh://192.168.16.128:22/ does not support password authentication.”?

I've updated Kali 2.0 to newest version - it is installed using VMWare. Now, every time I use hydra to brute-force SSH, I get the following error: [ERROR] target ssh://192.168.16.128:22/ does not ...
1
vote
1answer
72 views

Is there any methods available other than brute force and dictionary attacks?

I am curious to know about the wifi attacks. And I have known a little bit about brute force attack and dictionary attack. Is there any other methods available other than these two...?
-1
votes
1answer
79 views

Subdomain scanner without brute-force attack? [duplicate]

It is possible to scan subdomains of network without brute-force attack? If yes, how it works? I tried to scan the network with some penetrating tools and it returned to me subdomain which doesn't ...
1
vote
2answers
139 views

BurpSuite Brute Force Iteration

I am working on a security assessment for an online application. When testing the pin verification mechanism and possibilities of brute force, I came across a post request that looks like the below ...
1
vote
2answers
3k views

How to prevent DirBuster to stop listing apache server side files

I have deployed a php project on apache. When I use DirBuster tool to scan my site, it lists all server side files. I want to stop this listing. I have modified the permission. When I give the less ...
12
votes
4answers
4k views

Wordpress Brute Force Attacker knows real admin Username -

I've noticed a brute force attempt on several different Wordpress installs that know the right admin user name for those respective sites... It seems very strange that the hacker would be able to ...
-2
votes
2answers
610 views

How secure is aes-256-cbc with a 40 char password [closed]

I'm using this command from this article to encrypt a file: openssl enc -aes-256-cbc -in /etc/services -out services.dat -k MYPASSWORD If MYPASSWORD is 40 characters in length, roughly how long ...
1
vote
1answer
108 views

Is it possible to prevent WiFi password brute-forcing?

Are there any measures I can set, except using a better password, to prevent someone brute-forcing a WiFi password?
1
vote
1answer
140 views

Windows server 2016 Remote Desktop username leaked

One of our servers got infected with ransomware last week (Matrix, .Grhan). The server allowed remote desktop connection from outside on the default port, which was a big security hole (and also, the ...
6
votes
2answers
41k views

Is it possible to crack a PIN / PUK code on a phone SIM card?

When deploying a mobile phone best practices policy, one of the points which were raised was the requirement for the user to protect his SIM card with a PIN. The theory is that three failed attempts ...
7
votes
3answers
1k views

Can using emojis make someone's password safer?

I was just thinking about this the other day, after reading about making safe passwords, you have a few options: The first would be, adding numbers, or something other than just a word ...
0
votes
0answers
23 views

How secure will it be to use “Google Docs long url” like authentication scheme for orders in my online shop? [duplicate]

For the sake of simplicity, instead of full-fledged authentication with login and password, I want to create "Google Docs long url" authentication scheme for my internet shop for the users. To let ...
0
votes
1answer
103 views

Question about birthday attack on password

Based on birthday attack, you need to generate at least 2^n/2 of possible combination to have 50% chance of finding a password. I have a list of 3000 random password make from 16 characters of upper, ...
9
votes
3answers
6k views

Session Hijacking through sessionId brute-forcing possible?

cookies usually contain a sessionId to keep track of a logged user. What would prevent a malicious user to forge millions of requests with random sessionIds and send them to a server, hoping to ...
3
votes
1answer
99 views

Why does Authenticated Encryption not decrease confidentiality?

Recently, another question here made me start thinking about authenticated encryption. In my understanding AE allows to check whether a key is valid for decryption without even decrypting the ...
5
votes
2answers
3k views

Do you need more than 128-bit entropy?

UUID uses 128-bit numbers. Currently it is not feasible to randomly produce two UUIDs that are the same. Does that mean 128 bits of entropy is suitable for all cryptographic operations? I would ...
6
votes
3answers
2k views

Is a password easier to brute force if it contains a repeating pattern?

My question is different from this previous question: Does repeating one word to form a password result in a similar pattern in its encrypted format?. I'm specifically wondering about brute force ...
1
vote
2answers
878 views

Bruteforce Veracrypt

I forgot my Veracrypt password, I have around 1000-2000 possible password combination and I need a software to bruteforce the password on Windows. What software would that be?
0
votes
1answer
66 views

Please may I know why I am getting this Sshd log

why I am getting this sshd log Feb 1 13:07:57 sshd[6453]: Failed password for root from 193.34.22.63 port 28980 ssh2 Feb 1 13:08:26 sshd[6897]: Failed password for root from 91.205.189.15 port 48155 ...
0
votes
1answer
63 views

How to create combinations of a password [duplicate]

I don't remember my password, I can't remember exactly the variation. How can I brute force all the permutations of a word knowing the following conditions: Idea of the word (in my mind). Lower and/...
0
votes
3answers
244 views

How often do brute force attacks find the password or key in a much shorter amount of time than the theoretical max?

For a 128-bit key, it would theoretically take many years and a percentage of the entire worlds power output to check every possible key, or for 256-bit it would take 3 sexdecillion years. But the ...
0
votes
1answer
318 views

Using THC Hydra to attack Cisco router

I am trying to do successfull attack on my cisco home router using THC Hydra. I already know a username/password(admin/admin). First with nmap I looked for open ports on router and only opened one ...
0
votes
1answer
112 views

Program for guessing a url [duplicate]

I had an old soundcloud account where i privated one of my songs. After many years, I would like to listen to the track, but i don't remember what email was linked to the account or the password. All ...
0
votes
0answers
110 views

Can a smartphone's PIN or password be brute-forced in an offline attack?

I know of exhaustive offline dictionary and brute-force attacks against any given online account, but can the same method be applied against phones, either Android/iPhones? Or would any such attack be ...
0
votes
1answer
85 views

How do these attackers find my IP? [duplicate]

Recently, I have been reading a lot of my ubuntu log files (in /var/log/auth.log), and I can see that some IP addresses are actually trying to 'brute-force' their ways into my VM using SSH by testing ...
91
votes
7answers
13k views

Script Kiddies - how do they find my server IP?

I've set up a site on Digital Ocean without a domain yet, so there is only the IP. Despite telling no-one of its existence or advertising it, I get hundreds of notices from fail2ban that various IP's ...
27
votes
1answer
8k views

How does the attacker know what algorithm and salt to use in a dictionary attack?

I am curious about password cracking methods like dictionary and brute force attacks. Nowadays passwords are stored as hashes and not plaintext on the server. Then how can the plaintext passwords in ...