Skip to main content
Share Your Experience: Take the 2024 Developer Survey

Questions tagged [brute-force]

An attack using every possible input to attempt to produce the correct output. Typically the method of last resort when no weakness allows the use of a more restricted input set. E.g. trying all possible (or likely) passwords, in an attempt to guess the correct one.

Filter by
Sorted by
Tagged with
28 votes
3 answers
86k views

Why does Hydra return 16 valid passwords when none are valid?

I've been playing around with Hydra and DVWA and I've hit a bit of a snag - Hydra responds letting me know that the first 16 passwords in my password list are correct when none of them are. I assume ...
DKNUCKLES's user avatar
  • 9,217
126 votes
10 answers
18k views

How critical is it to keep your password length secret?

Is keeping your password length secret critical to security? Does someone knowing that you have a password length of say 17 make the password drastically easier to brute force?
Crizly's user avatar
  • 2,617
71 votes
3 answers
128k views

How to estimate the time needed to crack RSA encryption?

How to estimate the time needed to crack RSA encryption? I mean the time needed to crack Rsa encryption with key length of 1024, 2048, 3072, 4096, 5120, 6144, 5120, 7168, 8192, 9216, 10240, 11264, ...
Predator's user avatar
  • 961
43 votes
9 answers
9k views

Do non-keyboard characters make my password less susceptible to brute forcing?

I can put characters in my password for which there are no keys on a keyboard. On Windows, Alt+#### (with the numpad) inserts the character for whatever code you type in. When I put this in a ...
jnm2's user avatar
  • 1,782
92 votes
6 answers
14k views

Script Kiddies - how do they find my server IP?

I've set up a site on Digital Ocean without a domain yet, so there is only the IP. Despite telling no-one of its existence or advertising it, I get hundreds of notices from fail2ban that various IP's ...
microwth's user avatar
  • 2,473
67 votes
8 answers
28k views

Am I experiencing a brute force attack?

When checking the auth log of a server with the command: grep sshd.\*Failed /var/log/auth.log | less I see thousands of lines like this: Jan 12 11:27:10 ubuntu-leno1 sshd[8423]: Failed password ...
syldor's user avatar
  • 761
26 votes
5 answers
12k views

What's the practical limit for rainbow-table based bruteforce?

Say we have a hash of a password. The password can be considered to be made of of totally random characters and has a fixed length of N. The hash is SHA1(password+salt), where the salt is of length M. ...
mhswende's user avatar
  • 866
5 votes
1 answer
5k views

Maximum tries for 2FA code?

I am building a website and I am implementing two factor authentication (2FA). The second factor will be a random 6 digit code like those from Authy. This site will store very confidential information....
Eelke's user avatar
  • 516
28 votes
6 answers
175k views

Is it possible to brute force all 8 character passwords in an offline attack?

This article states: Brute-force techniques trying every possible combination of letters, numbers, and special characters had also succeeded at cracking all passwords of eight or fewer characters. ...
Stephen Ostermiller's user avatar
18 votes
4 answers
23k views

Calculate time taken to break AES key

A 256 bit AES key is required to be broken using the brute force method on a 2GHz computer. How long would it take to break the key in the best case and in the worst case situations? Assume that 1000 ...
Nadishan's user avatar
  • 283
6 votes
8 answers
2k views

Does it take longer to brute force a password starting with z than one starting with a?

I was wondering about the following: If someone tries to get my password with Brute Force, will a password starting with "a" guessed faster than one starting with "z" ? In this case assume the ...
print x div 0's user avatar
34 votes
5 answers
23k views

How unlikely is it that a Google Doc link is guessed?

Most (if not all) of us know that a Google Doc link looks something like this: https://docs.google.com/document/d/13P3p5bA3lslqEJT1BGeTL1L5ZrQq_fSov_56jT9vf0I/edit There are becoming several tools (...
Wayne Werner's user avatar
  • 1,835
24 votes
2 answers
55k views

Brute Forcing Password to a Truecrypt-encrypted file with Partial Knowledge

A while back, I encrypted a few files with Truecrypt, and stored the password in my head. Now I need to access it again, the password isn't working. I'm sure most of it is right, but I'm off by one or ...
Robyn's user avatar
  • 241
22 votes
1 answer
8k views

Timing attacks on password hashes

Timing attacks can have a devastating impact in scenarios where the secret is involved, often in cases where byte-wise array comparison is used. Now there are those that advertise using constant ...
emboss's user avatar
  • 4,348
7 votes
5 answers
68k views

How long would it take to bruteforce an AES-128 protected pdf knowing the key is 20 letter long and that the charset is A-Z,0-9?

The question says everything, knowing that a pdf is protected using standard Adobe password encryption that comes with Acrobat Pro (which as far as i know is AES 128) how much would it take to ...
Blobber's user avatar
  • 71
3 votes
2 answers
5k views

Partially forgotten encryption password

I encrypted important files with Veracrypt and I remember most of the password but some parts are forgotten. I need some advice as to what would be the most efficient way of getting the encryption ...
Xem's user avatar
  • 41
3 votes
1 answer
12k views

How do we estimate the time taken to crack a hash using brute force techniques

A German hacker famously managed to brute force crack a 160 bit SHA1 hash with passwords between 1 to 6 digits in 49 minutes. Now keeping everything constant (hardware, cracking technique - here brute-...
dozer's user avatar
  • 241
37 votes
2 answers
9k views

When could 256 bit encryption be brute forced?

Assuming quantum computing continues to improve and continues to perform like this: ... quantum computer completes 2.5-billion-year task in minutes is it reasonable to expect that 256 bit encryption ...
stevec's user avatar
  • 1,280
26 votes
5 answers
2k views

What concrete parameters can I change to make my passphrase-protected private gpg key more secure

There are several questions which discuss the resistance of passphrase-protected private gpg keys against brute force attacks. It seems, this kind of discussion could go on forever. Rather than ...
Martin Vegter's user avatar
22 votes
5 answers
119k views

How to generate dictionary for a dictionary attack?

I need to crack my own password. Advantage is that I know possible characters and maximum length. What I need is to create a dictionary. The dictionary should contain all the combos of characters ...
RhymeGuy's user avatar
  • 323
14 votes
6 answers
66k views

How can I generate custom brute-force dictionaries?

I have found during testing that companies often use variations of their names for critical passwords (for example Microsoft's password might be M1cr0s0f+ or m1cros0ft etc etc). So if I gave it the ...
NULLZ's user avatar
  • 11.5k
9 votes
1 answer
20k views

Bruteforce with hashcat, how to set the mask properly?

Let's say I've an hash of this type: test::::4e45c7bab093d7011e9b3a5df7d9fa88212beac5ac9c8c47:d6ff3373aa353f3b:123456 I would like to bruteforce it using hashcat, but I'm failing to set the correct ...
MeaMelone's user avatar
8 votes
2 answers
17k views

Automated URL Discovering

I built a simple server containing static files at /files/ and I'm attempting to discover them using automated tools. I'm using wfuzz to brute force on the URL but is that the only way? Is there any ...
jviotti's user avatar
  • 521
2 votes
2 answers
14k views

Has the WPS brute-force cracking issue been fixed?

I have heard a rumor that the WPS brute force attack doesn't work on newer devices. Is that true?
Smit Johnth's user avatar
  • 1,791
56 votes
7 answers
72k views

Invalid users trying to log in to my server

I'm seeing a lot of log entries that appear to be failed login attempts from unknown IP addresses. I am using private and public keys to log in with SSH but I have noticed that even with private ...
mk_89's user avatar
  • 671
52 votes
4 answers
52k views

Are salted SHA-256/512 hashes still safe if the hashes and their salts are exposed?

Scenario: a database of hashed and and salted passwords, including salts for each password, is stolen by a malicious user. Passwords are 6-10 chars long and chosen by non-technical users. Can this ...
Seppo Erviälä's user avatar
35 votes
2 answers
43k views

Why are GPUs so good at cracking passwords?

What is it about GPUs that lets them crack passwords so quickly? It seems like the driving force behind adopting good key-derivation functions for passwords (bcrpyt, PBKDF2, scrypt) instead of ...
Nick's user avatar
  • 455
32 votes
12 answers
15k views

Could I recover the content of file from its checksum/hash?

Let's say I have a video file that is split into multiple parts. Each piece is 2 Megabytes. I also have a list of the *insert hash name here* for each piece and also for the full file. Now assume ...
beppe9000's user avatar
  • 565
27 votes
4 answers
28k views

how long does it take to actually generate rainbow tables?

I've been reading up about rainbow tables as I think they're quite interesting cause they're actually a pretty simple concept. Anyway, I was wondering, has anyone been involved in actually generating ...
stickman's user avatar
  • 1,590
14 votes
1 answer
107k views

Forgot password to 7-Zip archive

I think I already know the answer to this question, but I thought I'd ask the experts anyway. A few months back, I created a password-protected 7-Zip archive which housed the source code of a simple ...
Matthew's user avatar
  • 343
11 votes
4 answers
3k views

Password entropy in layman's terms

Entropy is a term used often in relation to password security and brute-force attacks, but it is a topic that can get complicated quickly. What is the best way to describe password entropy (what it is ...
jrdioko's user avatar
  • 13.2k
8 votes
4 answers
7k views

Can anti-CSRF token prevent bruteforce attack?

I am not much experienced with brute force attacks but I was wondering Suppose, you have a website www.example.com and you want to do brute force attack on that login form but that login form is ...
Deepanshu Singh's user avatar
7 votes
3 answers
2k views

How to (further) ensure SSH security?

I set up my Linux Ubuntu machine as an SSH server through no-ip.com and it works great. Recently I discovered the command, sudo lastb -ad -F -w which outputs a log of the most recent failed SSH ...
khaverim's user avatar
  • 173
6 votes
4 answers
1k views

Can't brute force password cracking somehow be throttled?

Online articles mention the importance of a strong password and suggest that hacking tools allows bad guys to attempt millions of passwords per second. I am wondering why OSes and websites and such ...
Mario's user avatar
  • 423
5 votes
2 answers
10k views

What are realistic rates for brute force hashing?

I'm trying to gauge password strength assuming that the attacker has a hash of my password. Can anyone cite some realistic contemporary rates at which someone could perform various hashes? I know most ...
brianmearns's user avatar
4 votes
2 answers
927 views

How can you I detect low frequency brute forcing over multiple connections?

While I realize that servers can easily detect brute forcing strategies via a single I.P, it seems that servers would be vulnerable to a distributed attack from a botnet, with each computer attempting ...
MrSynAckSter's user avatar
  • 2,040
3 votes
3 answers
7k views

Bruteforce Veracrypt

I forgot my Veracrypt password, I have around 1000-2000 possible password combination and I need a software to bruteforce the password on Windows. What software would that be?
user19's user avatar
  • 31
1 vote
1 answer
548 views

Should a CDN service like Cloudflare protect against Brute Force Attacks, or only from DDoS?

I know that CDN services usually protect a user by hiding it's original machine's IP and by screening (and banning) any attackers that send too many requests in the form of DDoS. But should a CDN ...
Arcticooling's user avatar
1 vote
1 answer
3k views

Hydra HTTP Form Post with parameters containing a colon ":"

I'm trying to brute force login on my domain using THC Hydra v9.1-dev. It is using an ASP.net form and some of the required post body parameters contain a colon : in them which is the separator used ...
mahmoudafer's user avatar
139 votes
9 answers
341k views

Where can I find good dictionaries for dictionary attacks?

I’m wondering where I can find good collections of dictionaries which can be used for dictionary attacks? I've found some through Google, but I’m interested in hearing about where you get your ...
Chris Dale's user avatar
  • 16.1k
91 votes
9 answers
19k views

Is it possible make brute-force attacks ineffective by giving false positive answers to failed log-in attempts?

I don't have any experience or scientific knowledge in security, I just wanted to ask if this is possible because I am interested in it. What if I encrypt data and every password decrypts it, but ...
Tweakimp's user avatar
  • 881
42 votes
1 answer
19k views

How does the attacker know what algorithm and salt to use in a dictionary attack?

I am curious about password cracking methods like dictionary and brute force attacks. Nowadays passwords are stored as hashes and not plaintext on the server. Then how can the plaintext passwords in ...
andjava's user avatar
  • 598
35 votes
7 answers
7k views

How to know if a file is decrypted or not

For school, I have to do an exercise in which I have to decrypt files by brute force attack. There are a lot of different files in different file formats. The files have been encrypted using XOR or ...
juan michelle's user avatar
28 votes
4 answers
11k views

Should I implement incorrect password delay in a website or a webservice?

With arguments expressed in this answer, there is a few seconds delay between user enters an incorrect password and when he/she actually learns, that password was incorrect. This security solution is ...
trejder's user avatar
  • 3,639
28 votes
3 answers
7k views

Use multiple computers for faster brute force [duplicate]

I've watched Mr. Robot lately and can't stop thinking why it was so hard to decrypt files encrypted using AES encryption with a 256-bit key. Let us say the only method to find the key is through brute ...
Mero55's user avatar
  • 845
25 votes
3 answers
15k views

Is this what a brute force SSH attack looks like?

I reviewed the auth.log file on my Ubuntu server to find: [preauth] Feb 22 17:39:18 code-storage sshd[17271]: Disconnected from 147.135.192.203 port 49408 [preauth] Feb 22 17:40:15 code-storage sshd[...
David Kamer's user avatar
24 votes
4 answers
11k views

Protection against account lockout DoS

Any ideas on how to protect against the following scenario? Company x uses active directory for authentication of it's employees. The company has multiple authentication points that are semi-public ...
Josh Brower's user avatar
  • 1,387
20 votes
4 answers
308k views

Wordlists on Kali Linux?

I notice that in /usr/share/wordlists in Kali Linux (former Backtrack) there are some lists. Are they used to bruteforce something? Is there specific list for specific kind of attacks?
Stephenloky's user avatar
19 votes
1 answer
2k views

General purpose slow/unique hash routine for dup checking of private data, without storing the data itself?

I am wondering if there is a percentage of uniqueness known to be lost with every repeat of various hash routines, like MD5, SHA1, and how that might compare with other algorithms. If theoretically I ...
700 Software's user avatar
18 votes
3 answers
101k views

What are the differences between dictionary attack and brute force attack?

Can someone explain the major differences between a Brute force attack and a Dictionary attack. Does the term rainbow table has any relation with these?
Anandu M Das's user avatar
  • 2,057