Questions tagged [brute-force]

An attack using every possible input to attempt to produce the correct output. Typically the method of last resort when no weakness allows the use of a more restricted input set. E.g. trying all possible (or likely) passwords, in an attempt to guess the correct one.

Filter by
Sorted by
Tagged with
3
votes
1answer
70 views

To what extent should we defend against leaked credentials being tested against our system?

We see these kinds of attempts with some frequency. Normally a leak has happened from some other 3rd party, and an attacker has a big list of known account + password combinations that they can try ...
1
vote
1answer
895 views

cyberattack by password guessing admin account logon type 3

We have a 2008 R2 virtual server that is only used for logon via rdp or from local console. No VPN traffic is required. The server was under attack for a couple of days, viruses where installed etc. ...
2
votes
0answers
234 views

How easily could a picture password be hacked with brute force? [duplicate]

In Windows 8.1 Microsoft introduced a method to login using gestures over a picture. The picture password is determined by size, position and direction of any combination of circles, straight lines ...
3
votes
1answer
2k views

How to brute force a login page of an IP camera created in .asp?

I am new to stackexchange. I desperately need some help. I am doing my thesis on 'IoT Threats', one of my objectives is to try to brute force into an IP camera. I am using Kali Linux Hydra to do the ...
3
votes
0answers
696 views

Are enterprises Office 365 accounts overly exposed to brute force attacks?

Earlier this year the Scottish parliament was attacked by what described as a “Brute Force” cyber-attack. It was said that the attack targeted “MSPs and staff with parliamentary email addresses”. ...
4
votes
1answer
1k views

Why brute-force the password instead of the key directly?

This answer on another question on security stackexchange by a very reputed user explains why he prefers GnuPG over OpenSSL for file encryption. From what I understand, it can be summarized as this: ...
0
votes
1answer
329 views

Some questions about protecting recovery seed for Trezor/Nano S

If someone stole recovery seed (24 words) but you would protect it with additional passphrase, is it likely they could brute force your passphrase? How many guesses can there be made per second? ...
1
vote
1answer
181 views

Is signing safe from brute force attacks?

I am using itsdangerous to sign a string using a secret key. It says that the signing mechanism is HMAC and SHA1 and that it is an implementation of the Django signing module. Assuming I use one ...
0
votes
1answer
384 views

WordPress 4.7.2 Authentication Cookie Brute-force

I recently came across a WordPress (v 4.7.2) site with an exposed wp-config.php file, within which plain text server authorisation key secrets were accessible. Having read Mike Czumak's article on ...
-4
votes
1answer
1k views

What makes brute force attack faster? [closed]

My question was, What makes brute force attack faster? Is it a bigger RAM, larger storage or a faster processor... because I saw a video of a man who put 7 GTX 1080's in parallel and it hacked a lot ...
3
votes
2answers
3k views

Should I use rainbow tables or bruteforce (NTLM)?

As part of security testing, I will receive around 150 to 200 Active Directory password hashes from Windows Server 2012 R2 (using NTLM?). I have found NTLM rainbow tables (1,5 TB total), that covers ...
3
votes
1answer
180 views

Brute forcing an OnePlus 5

I've never done a brute force before and I wanted to try it out on my phone. Considering there are 0-9 digits and 4 spaces, that gives me 10^4 combinations. I wanted to know how I can connect my Mac ...
0
votes
0answers
101 views

Protect unauthenticated interface from guessing attacks

I am currently encountering a publically available interface; accessible at least via web form/webviews and some stateless protocol (presumably REST). In the past this form allowed you to view your ...
0
votes
2answers
429 views

Key(session token) authentication vs default login/pass authentication

I am building web application and have an idea to build custom authentication system, which would be quick and secure. I do not want to use almost "default" login (email) / password combination. I ...
3
votes
3answers
2k views

What is a quantum computing attack?

As far as i know, a quantum attack is a brute force attack performed by a quantum computer. source: wiki Is this very simple definition correct ? or the scope of a quantum computing attack is bigger....
1
vote
1answer
2k views

How many passwords per second can a typical computer check? [closed]

I wanna know how many passwords per second my computer can check this is for brute force attacks. I looked everywhere and on this website and the computer listed on here are nothing similar to the one ...
5
votes
2answers
2k views

How to brute-force a somewhat remembered aescrypt password?

I have a file I encrypted with AES via aescrypt about 5 years ago. I remember a lot of things about the password with several prefixes and suffixes. I have experience as a programmer but not with ...
0
votes
1answer
174 views

Decrypt data with known text

So I have an encrypted text file that I know contains the phrase "potatoes are awesome" Is there a way for me to decrypt the text based on me knowing that phrase and the encrypted data? (I also don't ...
0
votes
1answer
952 views

Defence for brute force attacks to ssh

At some point in the past I had a small (physical) webserver. From day 1 there were brute force attacks to ssh. I looked it up a bit and I set up iptables to block IPs that try to connect to ssh more ...
4
votes
1answer
1k views

How does a private OpenPGP key's passphrase add to its security?

I am a novice user of OpenPGP. I use GPGTools for OS X. I have several connected questions, but difficult to find direct answers on the Internet. When I create a key-pair, the password I enter is a ...
3
votes
2answers
2k views

Placing IP address in JSON web token or session cookie

I'm relatively new to security and I'm looking to prevent brute force logins on a web application I'm creating. After doing some research, I decided to go with requiring a captcha after a user ...
0
votes
3answers
681 views

Can X.509 Authentication be subject to brute force attacks?

I am working on an application (using Spring Security) that has two possible user authentication mechanisms: either X.509 certificate (using mutual SSL handshake) or user + password For user+...
-2
votes
1answer
743 views

Directory Traversal or File System Permissions? [closed]

A network administrator discovers several unknown files in the root directory of his Linux FTP server. One of the files is a tarball, two are shell script files, and last one is a binary- file is ...
1
vote
4answers
463 views

Understanding how to prevent rapid-fire login attempts

I'm having problems to fully understand how to prevent rapid-fire login attempts. My questions basically come from the The definitive guide to form-based website authentication. The final ...
8
votes
1answer
11k views

Bruteforce with hashcat, how to set the mask properly?

Let's say I've an hash of this type: test::::4e45c7bab093d7011e9b3a5df7d9fa88212beac5ac9c8c47:d6ff3373aa353f3b:123456 I would like to bruteforce it using hashcat, but I'm failing to set the correct ...
1
vote
0answers
336 views

Why Aren't CA Private Keys Vulnerable to Brute Force Hacking [duplicate]

I have read a bit about encryption up to this point and understand that server certificates are validated by having a Certificate Authority validate that certificate contents match the digital ...
1
vote
2answers
3k views

Is it possible to bruteforce a cvv code?

If I'm not wrong, the cvv code almost always follows a certain pattern based on the credit card number and dates. What are the possibilities to go through to hypothetically bruteforce a cvv code? Is ...
0
votes
0answers
109 views

Hydra returning error: “module option must start with http”

I am trying to brute force a web login password using hydra with the below command: hydra -s 8123 -x 2:8:aA1 -t 16 -m http://192.168.1.193 http-proxy I get [ERROR] module option must start with ...
1
vote
1answer
760 views

John the Ripper and incremental mode

I have a question about John the Ripper and it's incremental mode. As far as I know, the incremental mode is a brute-force mode, and it tries to get the password by systematic combining all ...
9
votes
1answer
510 views

How to get and use constantly changing cookie JSESSIONID values in Hydra?

Related: how to get cookies from aspx site to use it with hydra My problem is similar to the above case, I get "20 valid passwords found" but the server I'm trying to brute force sends the header set-...
1
vote
1answer
1k views

brute force ssh account with key-pair authentication?

Recently one of my servers has been hacked and it seems they got SSH access (logs are removed, ransom readme files created etc..). The account has a ssh certificate authentication (incl. passphrase ...
0
votes
1answer
524 views

Kali Linux Hydra question

Recently a friend of mine coded a website and he asked me to brute force it to test it HTML code of the page trying to use hydra on https://pastebin.com/D2iQXrNb (use Pastebin because I don't know ...
1
vote
0answers
94 views

No fields captured in BurpSuite

I am using burpsuite to bruteforce my routers login form, but I have encountered an issue... When I enter something into the password field, BurpSuite shows the request, but not what was entered. For ...
2
votes
3answers
1k views

Can I slow down a brute force attack by encoding password input data?

I'm building a php login form with only a username & password as $_POST data. But before submitting the form, a JS function check() will base64_encode the password input, then finally submits the ...
1
vote
2answers
1k views

Preventing a Brute Force Attack on API via limiter

I have an API that users can log into. I don't want it to be hacked. What if I limit each user to 60 requests a minute? Won't this significantly slow hackers down in a brute force situation?
1
vote
0answers
3k views

Brute Force with Hydra Ignore timeout and 4 billion limit

We are doing an assignment where we are hacking eachothers websites or servers in school. I know the default username and know the default password is 32 characters long to ssh in. While I know I ...
9
votes
3answers
426 views

How to calculate brute forcing times/feasibility for remote attacks to include parallelism?

This is purely a thought exercise. Assume a server which does not implement throttling or lock on failed attempts. The server accepts a username/password request & sends back a Yes/No response. ...
3
votes
2answers
547 views

Should I publish IP addresses that try to brute force my private web server?

Ethically and legally, am I allowed to publish IP addresses that tried to brute force my LAMP server? It's a personal website/blog that gets brute forced a lot and I would like to publish them to my ...
2
votes
3answers
1k views

How to stop brute force attack that is DDoSing our server?

We have a web application and that's been frequently hit with random username and password to find a successful login attempt. We introduced CAPTCHA, random token generation but that didn't stop the ...
1
vote
2answers
59 views

In what cases should applications be prepared for brute force?

Today I had an idea: I've been thinking that one can use brute force to get some data from a university from our country. It turned out my thoughts were true: an attacker can use brute force to ...
2
votes
0answers
1k views

Intercepting hydra with burp suite

I'm using burp suite as a proxy and when I run hydra, burp suite should be able to catch that and log it in HTTP history, but instead of that I get the error Can not connect [unreachable] I tried ...
2
votes
2answers
586 views

Do I need a “cryptographically secure” random value for an unguessable URL?

tl;dr: Is a pseudorandomly generated string unguessable enough to be used as token in a URL? I'm making a web application, let's for the sake of argument assume it's another PasteBin. I allow users ...
33
votes
5answers
8k views

SSH - If Eve has the passphrase and public key, can she derive the private key?

I have used ssh-keygen for creating an RSA 4096-bit SSH private and public key pair. I used a passphrase for the private key. If an attacker, Eve, knows the passphrase in addition to the public key: ...
1
vote
1answer
354 views

Brute force email in JSON format

I have a parameter args=[490114,{"user_login":"user@example.com","":"","perm":"view","partners":[],"event_labels":[]}] in the HTTP request but in the encoded format. I want to brute force this ...
7
votes
3answers
5k views

Which is faster - brute-forcing, or using a dictionary attack that contains all possible permutations?

Assuming a 6-character password uses the mixalphanumeric charset, giving each character a character set of 62 and the entire password a keyspace of 62^6 = 46.6 billion (if my calculations are correct)....
4
votes
2answers
503 views

What's the correct term form a pre-computed table with password/hash pairs?

The table looks like this: 123456 -> asfty18u78t489yh password -> 89y203rupdifhof something -> 2r892389n89rfsd And the idea is that if you have the hash (asfty18u78t489yh), you know ...
0
votes
1answer
129 views

Distinguishing Between Brute force and Crawlers in error reporting

I have been receiving a great many emails recently reporting issues within my website that, when gone back and looked up, have been reported as being Brute force attacks. Upon further inspection of ...
3
votes
1answer
430 views

Is logging into SSH with a 2048 bit SSH password less secure than logging in with a a 2048 bit private key? [duplicate]

I'm certainly not saying this is a "good idea," and I always disable password authentication on SSH servers. However, the question came up when talking to a friend: If your password is as long and ...
1
vote
2answers
2k views

Brute force HMAC SHA256 (HS256) equals to break JSON web token signature?

The format of JSON Web Token is: encoded (header). encoded(payload). signature with a secret (for example, use sha256 to sign). In case of hmac sha256 (HS256)-selected JWT, if the secret is not long ...
2
votes
2answers
102 views

Are complex passwords necessary in web applications? [duplicate]

If there is a web application that holds important data, how important is it to use a complex/long/secure passphrase? When I use for example something like "applefreezer" as password for my admin ...