Questions tagged [brute-force]

An attack using every possible input to attempt to produce the correct output. Typically the method of last resort when no weakness allows the use of a more restricted input set. E.g. trying all possible (or likely) passwords, in an attempt to guess the correct one.

Filter by
Sorted by
Tagged with
0
votes
3answers
305 views

Can ModSecurity defend from Brute Force Attacks on PHPmyadmin and WordPress as well?

Can the software ModSecurity defend from Brute Force Attacks on PHPmyadmin and WordPress as well? A particular hosting company providing shared hosting told me that ModSecurity should cover ...
4
votes
1answer
368 views

Wireshark HTTP continuations (Hydra HTTP version)

I am trying to use Hydra to brute force a HTTP POST form page, however the page is returning a HTTP Continuation I'm not sure what that is. This is being caused by the HTTP/1.0 at the top of the ...
2
votes
2answers
902 views

Is it still possible to run an online dictionary attack from a single machine, without anonymisation?

This question concerns dictionary attacks conducted: Over the Internet, using programs like THC Hydra Via protocols such as HTTP, FTP and SMTP I believe I'm right in thinking that: a) due to the ...
4
votes
1answer
479 views

How to brute force a Java Applet in browser?

I am solving a CTF challenge and it is multi-layered: https://net-force.nl/challenge/level314/ (Modern browsers don't support Java Applets anymore and I had to download Opera browser 9.x to run the ...
-4
votes
1answer
92 views

Using 128-bits as an input for hashing using SHAKE-3 (128-output)

I would like to know the time estimate for a brute force attack to break my input (128-bit) which means 2^128 possibilities are there. Any online tool for that or any article which talks about that?
0
votes
1answer
354 views

RDP Audit Failures Brute Force Attacks

I need some help on tracking the source of these RDP access attempts on our terminal server. Port 3389 is open on the firewall (I know this is a terrible practice. I don't want to hear advice on ...
0
votes
1answer
1k views

Efficient Way to Brute Force With Large Wordlist

I am considering attempting to perform an SSH brute force attack on my own device in order to test its security, but I have run into an issue with the wordlist. I know my own password format, as well ...
1
vote
1answer
2k views

How to use character mask in hashcat?

I do not get hashcat working the way I want. I got this handshake captured file. I can crack it with ?a?a?a?a?a?a?a?a --increment but since I know the password is between 14 and 16 charters that is ...
3
votes
0answers
554 views

Hydra does not display the right answer in DVWA

I have been trying for days now to use Hydra in an attempt to crack DVWA brute force but to no avail, I am using the correct session cookie and to my knowledge have the correct syntax? Query is: ...
3
votes
0answers
109 views

Why I have more than one valid passwords with Hydra? [duplicate]

I am trying to do a brute force with Hydra on a web page but it isn't DVWA so I don't have control over code. The failed result has 200 OK response and "Area protegida" message. I tried it with this ...
0
votes
1answer
93 views

Experiencing injection / brute force attacks

I'm handling a hosting services for website via WHM. Few months ago, I've been experiencing some automated attacks on the websites that I'm handling. See screenshots below: Are there any remedy for ...
98
votes
5answers
30k views

Someone is trying to brute-force(?) my private mail server… very… slowly… and with changing IPs

This has been going on for about 1-2 days now: heinzi@guybrush:~$ less /var/log/mail.log | grep '^Nov 27 .* postfix/submission.* warning' [...] Nov 27 03:36:16 guybrush postfix/submission/smtpd[7523]:...
4
votes
4answers
2k views

Brute force prevention: where and when?

I design a 'secure' login system. Let's focus in the brute force prevention. In my Android client I have a counter that counts the number of times that the user tries to login, with false credentials. ...
0
votes
1answer
214 views

What are the best algorithms against known plaintext attack?

I'd like to encrypt files and their metadata as well. They will be stored in some sort of database (not yet decided, probably pgsql). The metadata can be for example the creation time, the ...
0
votes
1answer
2k views

John the Ripper Character Lists

How is it possible to use or prioritize umlauted characters - ä ö ü ß Ä Ö Ü - whilst brute forcing. I'm not using any wordlist, only dozens of CPU threads via the following command : ./john --fork=...
4
votes
2answers
366 views

Quantum Computer Advantage in SSH Login

I understand that quantum computers are many orders of magnitude faster than today's binary computer and that this is expected to enable decryption that was unlikely (it would take too long) with ...
2
votes
3answers
585 views

How secure is a password made up of three or four three-letter words?

According to this, a password such as dinwryran is secure against a brute-force attack. Is this true? If not, why?
6
votes
1answer
1k views

How to interpret this statement against 4096-bit RSA

While I'd agree that double-sized RSA keys may pose more problems than the gain in security possibly justifies, I am having problems understanding the argument made here: https://gnupg.org/faq/gnupg-...
2
votes
1answer
387 views

Are there bruteforce programs that use letters of other languages? Arabic? Greek?

I came across a site that had the password strength meter. I tried using 'password' and the meter did not like my password. Then I happened to try 'password' but I used the arabic translation for 'a' ...
-1
votes
1answer
615 views

How do I find out how long a password is for a 7zip aes 256 encryption? [closed]

I lost password to a 7zip, nothing important in it. But i'll still like to access it. I heard there is a way to find out how long the password is, but I dont know how.
1
vote
1answer
158 views

Can SSL traffic encrypted with a weak cypher be bruteforced?

Take the following scenario: Attacker performs a man-in-the-middle attack on Client, redirecting the DNS records of www.example.com to point to a malicious server Client connects to the malicious ...
3
votes
2answers
2k views

bcrypt cost 10/12/14 brute force time?

Earlier I added bcrypt with cost 12 (15 is a bit too long for login, 12 looks about right). I'm also planning to add the https://howsecureismypassword.net/ open source version but I'd rather not ...
3
votes
1answer
71 views

To what extent should we defend against leaked credentials being tested against our system?

We see these kinds of attempts with some frequency. Normally a leak has happened from some other 3rd party, and an attacker has a big list of known account + password combinations that they can try ...
1
vote
1answer
1k views

cyberattack by password guessing admin account logon type 3

We have a 2008 R2 virtual server that is only used for logon via rdp or from local console. No VPN traffic is required. The server was under attack for a couple of days, viruses where installed etc. ...
2
votes
0answers
236 views

How easily could a picture password be hacked with brute force? [duplicate]

In Windows 8.1 Microsoft introduced a method to login using gestures over a picture. The picture password is determined by size, position and direction of any combination of circles, straight lines ...
3
votes
1answer
2k views

How to brute force a login page of an IP camera created in .asp?

I am new to stackexchange. I desperately need some help. I am doing my thesis on 'IoT Threats', one of my objectives is to try to brute force into an IP camera. I am using Kali Linux Hydra to do the ...
3
votes
0answers
720 views

Are enterprises Office 365 accounts overly exposed to brute force attacks?

Earlier this year the Scottish parliament was attacked by what described as a “Brute Force” cyber-attack. It was said that the attack targeted “MSPs and staff with parliamentary email addresses”. ...
4
votes
1answer
2k views

Why brute-force the password instead of the key directly?

This answer on another question on security stackexchange by a very reputed user explains why he prefers GnuPG over OpenSSL for file encryption. From what I understand, it can be summarized as this: ...
0
votes
1answer
336 views

Some questions about protecting recovery seed for Trezor/Nano S

If someone stole recovery seed (24 words) but you would protect it with additional passphrase, is it likely they could brute force your passphrase? How many guesses can there be made per second? ...
1
vote
1answer
182 views

Is signing safe from brute force attacks?

I am using itsdangerous to sign a string using a secret key. It says that the signing mechanism is HMAC and SHA1 and that it is an implementation of the Django signing module. Assuming I use one ...
0
votes
1answer
415 views

WordPress 4.7.2 Authentication Cookie Brute-force

I recently came across a WordPress (v 4.7.2) site with an exposed wp-config.php file, within which plain text server authorisation key secrets were accessible. Having read Mike Czumak's article on ...
-4
votes
1answer
2k views

What makes brute force attack faster? [closed]

My question was, What makes brute force attack faster? Is it a bigger RAM, larger storage or a faster processor... because I saw a video of a man who put 7 GTX 1080's in parallel and it hacked a lot ...
3
votes
2answers
3k views

Should I use rainbow tables or bruteforce (NTLM)?

As part of security testing, I will receive around 150 to 200 Active Directory password hashes from Windows Server 2012 R2 (using NTLM?). I have found NTLM rainbow tables (1,5 TB total), that covers ...
3
votes
1answer
191 views

Brute forcing an OnePlus 5

I've never done a brute force before and I wanted to try it out on my phone. Considering there are 0-9 digits and 4 spaces, that gives me 10^4 combinations. I wanted to know how I can connect my Mac ...
0
votes
0answers
106 views

Protect unauthenticated interface from guessing attacks

I am currently encountering a publically available interface; accessible at least via web form/webviews and some stateless protocol (presumably REST). In the past this form allowed you to view your ...
0
votes
2answers
468 views

Key(session token) authentication vs default login/pass authentication

I am building web application and have an idea to build custom authentication system, which would be quick and secure. I do not want to use almost "default" login (email) / password combination. I ...
3
votes
3answers
3k views

What is a quantum computing attack?

As far as i know, a quantum attack is a brute force attack performed by a quantum computer. source: wiki Is this very simple definition correct ? or the scope of a quantum computing attack is bigger....
1
vote
1answer
2k views

How many passwords per second can a typical computer check? [closed]

I wanna know how many passwords per second my computer can check this is for brute force attacks. I looked everywhere and on this website and the computer listed on here are nothing similar to the one ...
5
votes
2answers
2k views

How to brute-force a somewhat remembered aescrypt password?

I have a file I encrypted with AES via aescrypt about 5 years ago. I remember a lot of things about the password with several prefixes and suffixes. I have experience as a programmer but not with ...
0
votes
1answer
184 views

Decrypt data with known text

So I have an encrypted text file that I know contains the phrase "potatoes are awesome" Is there a way for me to decrypt the text based on me knowing that phrase and the encrypted data? (I also don't ...
0
votes
1answer
1k views

Defence for brute force attacks to ssh

At some point in the past I had a small (physical) webserver. From day 1 there were brute force attacks to ssh. I looked it up a bit and I set up iptables to block IPs that try to connect to ssh more ...
4
votes
1answer
1k views

How does a private OpenPGP key's passphrase add to its security?

I am a novice user of OpenPGP. I use GPGTools for OS X. I have several connected questions, but difficult to find direct answers on the Internet. When I create a key-pair, the password I enter is a ...
3
votes
2answers
3k views

Placing IP address in JSON web token or session cookie

I'm relatively new to security and I'm looking to prevent brute force logins on a web application I'm creating. After doing some research, I decided to go with requiring a captcha after a user ...
0
votes
3answers
754 views

Can X.509 Authentication be subject to brute force attacks?

I am working on an application (using Spring Security) that has two possible user authentication mechanisms: either X.509 certificate (using mutual SSL handshake) or user + password For user+...
-2
votes
1answer
826 views

Directory Traversal or File System Permissions? [closed]

A network administrator discovers several unknown files in the root directory of his Linux FTP server. One of the files is a tarball, two are shell script files, and last one is a binary- file is ...
1
vote
4answers
526 views

Understanding how to prevent rapid-fire login attempts

I'm having problems to fully understand how to prevent rapid-fire login attempts. My questions basically come from the The definitive guide to form-based website authentication. The final ...
8
votes
1answer
12k views

Bruteforce with hashcat, how to set the mask properly?

Let's say I've an hash of this type: test::::4e45c7bab093d7011e9b3a5df7d9fa88212beac5ac9c8c47:d6ff3373aa353f3b:123456 I would like to bruteforce it using hashcat, but I'm failing to set the correct ...
2
votes
0answers
378 views

Why Aren't CA Private Keys Vulnerable to Brute Force Hacking [duplicate]

I have read a bit about encryption up to this point and understand that server certificates are validated by having a Certificate Authority validate that certificate contents match the digital ...
1
vote
2answers
3k views

Is it possible to bruteforce a cvv code?

If I'm not wrong, the cvv code almost always follows a certain pattern based on the credit card number and dates. What are the possibilities to go through to hypothetically bruteforce a cvv code? Is ...
0
votes
0answers
113 views

Hydra returning error: “module option must start with http”

I am trying to brute force a web login password using hydra with the below command: hydra -s 8123 -x 2:8:aA1 -t 16 -m http://192.168.1.193 http-proxy I get [ERROR] module option must start with ...