Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [brute-force]

An attack using every possible input to attempt to produce the correct output. Typically the method of last resort when no weakness allows the use of a more restricted input set. E.g. trying all possible (or likely) passwords, in an attempt to guess the correct one.

0
votes
1answer
6k views

How did hackers brute force my Windows server username?

About a year ago my Windows server 2008 R2 server was hacked. I had RDP open to the world, I know, not a good idea. Being that it was a year ago I don't have any of the logs, but I was thinking about ...
1
vote
1answer
952 views

What is the recommended length for a phone PIN?

I recently read that you're supposed to have a phone pin consisting of at least six digits. Why? I'd get it if the pin was stored as a hash in a database, even though six digits would easily be ...
3
votes
2answers
591 views

Brute force algorithm to break symmetric key. How to find the program when current key is the correct one?

In a brute force program, sequential keys are tested against the public key in order to find the correspondent private key. My question is, how is the test done with each key that let you conclude ...
1
vote
3answers
750 views

Creating a wordlist knowing parameters

I need to crack my own router password. Advantage is that I know possible characters and maximum length. What I need is to create a dictionary. The dictionary should contain all the combos of ...
0
votes
1answer
284 views

Setting payload for email using burp intruder [closed]

I am setting up the burp intruder attack for email. For example, youremail@gmail.com Now when i added $ it takes youremail@gmail%2ecom so i am getting the result as email is invalid type. My aim is ...
3
votes
1answer
377 views

Which algorithm for login throttling

I'm about to add a throttle to a login page to stop it being brute forced easily. I was going to use the leaky bucket algorithm to implement the throttle on a per user/IP basis. Is this considered OK ...
0
votes
1answer
1k views

Brute force web page using Hydra [closed]

What is the problem in this command for hydra, it returns these errors: Command : hydra -l 950421521 -P /home/jarvis/Desktop/ams-2.lst 172.20.10.4 http-post-form "/login.aspx:&txtUserName=^USER^&...
41
votes
3answers
7k views

Should Failed Login Attempts Be Logged

Should failed login attempts be logged? My doubt is that if there is a distributed brute force attack, it might exhaust the available disk space of the database. What is the best practice for this? I'...
26
votes
8answers
6k views

How to respond to a SSH brute force attack on a single VPS?

I logged onto my VPS this morning to find millions of failed login attempts for the root user and other users that don't even exist. I took the below measures to try and obfuscate the attackers ...
1
vote
0answers
48 views

Is it possible to crack WPA2 faster than brute-force? If yes, how? [duplicate]

Does WPA2 have any weaknesses, flaws or gaps that would make a hack faster than brute-force possible? Maybe I can hijack authorized user's session or trick AP itp.
1
vote
0answers
175 views

Generating Rainbow Tables with Salt/Prefix [closed]

I would need a tool that would allow me to create rainbow table for custom password pattern. The pattern is 9-XXXXXXXXX where X is alphanumberic character and 9- is fixed prefix, as well as fixed ...
2
votes
1answer
677 views

Bruteforce App login forms on Android

I was wondering if there is any way (app or something) to bruteforce app login forms on Android?
0
votes
2answers
1k views

How customising a wordlist to make a bruteforce attack in leetspeak with hashcat or John the ripper

I'm trying to unlocking my encrypted external harddisk because I have lost my paper with the password. With the help of user3439894 I have a short program to injecting a wordlist and unlocking the ...
1
vote
1answer
2k views

OWASP ZAP bruteforce by password not username

I want to bruteforce a login page using OWASP ZAP, using two separate passwords (90 lines) and username (200 lines) files, with the bruteforce POST requests to be ordered by password like: user001:...
0
votes
1answer
2k views

How can one prevent HTTP-authentication Brute Force Attacks, on PHPmyadmin with CSF-LFD?

I use PHPmyadmin (PMA) to manage my SQL based DB on an Apache environment secured with CSF-LFD (that as I know, also called "Fail2ban"). I don't want to protect PMA by limiting it to a certain IP or ...
1
vote
0answers
253 views

Password Strength: Compound Words [duplicate]

I’m familiar with XKCD’s Correct Horse Battery Stable example but I am wondering about one aspect of password strength. Dictionary words are an easy target for password crackers. If you compound a ...
3
votes
1answer
604 views

Is TCP Sequence Bruteforcing dangerous nowadays?

I was reading about TCP sequence prediction which is described as almost impossible on all updated Operating System nowadays. The total amount of possible sequence numbers is 2^32-1 which, if we try ...
1
vote
2answers
5k views

How to recover a lost zip file password (Extract Zip Spec '2.0')

I want to recover my backup file, but I can't find the password. The password contains 12-20 characters (As!@$123) user@PC:/media/user/MyData$ zipdetails -v backup2.zip 0000000 0000004 50 4B 03 04 ...
4
votes
5answers
1k views

What makes one random strong password more resistant to a brute force search than another

The only way to do this is by making an educated guess on how the brute force algorithm works or probably works. Lets say you were trying to crack a combination lock with 3 discs each with 10 ...
58
votes
6answers
11k views

Wrong password - number of retries - what's a good number to allow?

Most sites & software seem to have a default of auto lock or time lock after 3 wrong tries. I feel that the number could be much higher - not allowing retries is mainly to prevent automated ...
15
votes
3answers
3k views

Are HTTP brute-force password-guessing attacks common nowadays?

Are brute-force attacks against online accounts (gmail, facebook, instagram) something that really happens? I don't mean something like cracking password hashes or DDoS, but real brute-force attacks (...
-1
votes
2answers
388 views

Limiting five letter string to only include words from dictionary in Crunch?

I am creating a word list for attacking a personal .dmg file on OS X. I'm using John the Ripper for the cracking, and Crunch to create the word list: ./crunch 13 13 abcdefghijklmnopqrstuvwxyz ...
2
votes
4answers
729 views

How to figure about the total amount of password combinations possibles that have salt values?

I'm reading this book about Computer Security to better prepare me for my role, however, this question is just not clicking to me. I've figured out half of it, but cannot figure out this last part. If ...
-1
votes
2answers
3k views

How do I brute-force a WPA-2 wifi with Aircrack-ng in Kali Linux?

What I basically want to do is, perform a test on my Wi-Fi and brute force it instead of a dictionary attack. I googled, and all of them showed me examples of dictionary attack and no bruteforcing. ...
0
votes
1answer
1k views

How do I change my IP Address after a specific number of loops in Python? [closed]

I have a for loop to brute force a Gmail account. But I've heard that Gmail's max attempts is 100. So how do I change my IP after 100 loops? Thanks in advance.
3
votes
1answer
314 views

Do any routers report a brute force attempt?

In our work office, we have a router but the password for it has been lost. We don't want to do a factory reset except as a last resort. I could try brute forcing the login, but I'm afraid that some ...
5
votes
1answer
4k views

Bruteforce part of password in TrueCrypt

I own a TrueCrypt container and I can't open it. I remember part of its password. So I want to bruteforce attack on it. I tried many parameters in oclHashCat but none worked (parameter problem). Can ...
-1
votes
2answers
3k views

Calculating permutations of a hexadecimal character set [closed]

How long would it take to run through all permutations/combinations of a ten character set; assuming the character-set is limited to a hexadecimal alphabet? (i.e. 16 characters {0..9}{A..F}; eg. ...
26
votes
4answers
8k views

How practical is it to bruteforce a 10-digit number via URL

Example URL www.[somewebsite].com/[10_digit_number] Getting the correct number loads a page. I know there would be 10 billion possible digits to choose from, but how long would it take? What are the ...
2
votes
3answers
743 views

How secure are pins on credit / bank cards?

Everyone owns a card from the bank. Every card has 4 digit pin. If someone steals / finds my card I know that this 10.000 combinations are silly stuff to crack. I presume with some piece of hardware (...
4
votes
1answer
104 views

Is decryption of past conversations a legitimate concern?

Suppose sensitive information is sent over an insecure channel, but it is encrypted with a cipher such as AES. As of this writing AES is not broken and brute-forcing it would take more than millions ...
6
votes
2answers
7k views

Cracking a JWT signature

I am testing an API that uses JWT for authentication. This JWT has a HS256 signature to prevent modification. I figured that if I determine the secret key used in this signature, I can create my own ...
3
votes
2answers
445 views

Does using characters specific to language make password stronger

So let's start of example. I live in England, and have a Polish keyboard. I can use Polish specific letters like ąćęłńóśżź, one could also use German ßäë etc. Would using those letters make password ...
4
votes
1answer
2k views

How to crack 10 digits with prefix password in John the Ripper?

I want to crack a password which pattern was 10 digits start with 0910 or 0912. So possible passwords would be e.g. 0910333444, 0910444566, 0912111222, 0912145632. How to configure the incremental ...
0
votes
3answers
907 views

Crack Linux password if you have plaintext and hash?

I have a relatively old Linux system, where password are not shadowed, therefore stored in /etc/passwd/. My question is, since I know the cleartext password, and its hash (looking at the passwd file),...
4
votes
5answers
910 views

Do password crackers / brute-force attacks put a higher priority on “picture-passwords”?

Some time ago I saw a post on reddit about someone with the seemingly very random username "78523965412369874123": If you trace those numbers on a usual keyboard-numpad, it spells out a swastika with ...
2
votes
1answer
588 views

Blocking brute forcer with multiple IPs in range

A few weeks ago, I allowed my Linux Server to be connected from the internet for development purposes. My networking knowledge is quite basic. Following some guidelines on securing Linux servers, I ...
1
vote
0answers
303 views

Are AliPay password rules making it easier to guess a password? [duplicate]

I recently went to change my password at AliPay, and found out that there are a few restrictions on the password: It can only be digits It must be six digits It can not consist of consecutive digits (...
0
votes
1answer
94 views

Does stretching a hash increase a denial-of-service (DoS) risk and does brute-force protection mitigates that?

Disclaimer: I noticed several questions on this site but none really answer this two questions directly. Therefor I do not consider this duplicate. Personally I really like the article called Some ...
4
votes
2answers
1k views

Brute Force RDP Attacks Despite Having RDP Restricted to 1 IP - HOW?

I restricted the Firewall incoming rules for RDP under Scope to 1 Remote IP address (Local IP Address section is empty). This was done for both Public & Private/Domain Rules. This action ...
-2
votes
2answers
608 views

How secure is aes-256-cbc with a 40 char password [closed]

I'm using this command from this article to encrypt a file: openssl enc -aes-256-cbc -in /etc/services -out services.dat -k MYPASSWORD If MYPASSWORD is 40 characters in length, roughly how long ...
90
votes
9answers
18k views

Is it possible make brute-force attacks ineffective by giving false positive answers to failed log-in attempts?

I don't have any experience or scientific knowledge in security, I just wanted to ask if this is possible because I am interested in it. What if I encrypt data and every password decrypts it, but ...
3
votes
1answer
3k views

Find salt from md5 hash if password is known

I have a salted MD5 hash and I also know the password. How can I recover the salt using tools like John The Ripper (I have JTR jumbo installed)?
0
votes
2answers
202 views

Why is it a problem to store strong passwords as unsalted hashes?

My users all have strong (80-bit true entropy) passwords. How do I know that? Because my imaginary website randomly generates the passwords for them (client-side). In that context, could you explain ...
2
votes
2answers
249 views

Bruteforcing hardware-encrypted SSD

Can you bruteforce a hardware-encrypted SSD drive? I mean recovering the password needed to unlock the drive. Is there any software could do this? Here the focus is the software that could do the job....
6
votes
1answer
2k views

How secure is a Windows 10 PIN not needing enter?

I've searched around about Windows 10 PINs and although have seen a few answers regarding the security of them as a whole, I haven't found any discussing the fact that when I type in my PIN, the ...
0
votes
1answer
690 views

Is HTTP POST insecure?

Is it possible to perform a MITM attack or even bruteforce a HTTP POST? If so how does one perform an attack and how can a developer protect his/her site from such an attack?
1
vote
3answers
9k views

How would I brute-force a Bitlocker recovery key?

I have imaged a hard disk and used passware, but to no avail - it says Encryption key External key, and not the actual key. How do you think I would go about brute forcing it? Lets assume I had ...
3
votes
2answers
2k views

How can SHA256-hashes as input to MD5 be revealed?

I know that you shouldn't use unsalted MD5 hashes of passwords in databases. But unfortunately, people do, see https://hashes.org/public.php. From this site I downloaded a file with passwords which ...
2
votes
1answer
462 views

Can I use John the Ripper to brute-force a password-protected flash drive?

I have a password-protected flash drive. The input window allows unlimited password attempts, but this form is not an encrypted file. Can I use John the Ripper to bruteforce the password?