Questions tagged [brute-force]

An attack using every possible input to attempt to produce the correct output. Typically the method of last resort when no weakness allows the use of a more restricted input set. E.g. trying all possible (or likely) passwords, in an attempt to guess the correct one.

Filter by
Sorted by
Tagged with
0
votes
2answers
1k views

How customising a wordlist to make a bruteforce attack in leetspeak with hashcat or John the ripper

I'm trying to unlocking my encrypted external harddisk because I have lost my paper with the password. With the help of user3439894 I have a short program to injecting a wordlist and unlocking the ...
0
votes
1answer
425 views

Robots trying to login to Azure VM when SSH port is closed in manager

I have many robots trying to do SSH login in a Azure VM. In the resource manager SSH is disabled but attacker IPs are public, as you can see below, where I copy a log for auth.log (I have an Ubuntu ...
0
votes
1answer
285 views

Why IOS on IPhone cannot be brute-forced programatically? [duplicate]

I am interested in the recent Apple case where FBI wants to get access, but they say it's not technically possible other than creating a new OS (or I guess just modifying the existing one). More ...
0
votes
1answer
3k views

Brute forcing using hydra

I'm try to do brute force attack on a system and I have complete word list of the possible passwords because they use a really simple format but when I tried hydra with the following post responses, ...
0
votes
1answer
246 views

Prevent brute force attacks on web publishing logins

Presumably, if someone tries to brute force into your website's control panel at your web host's site - they will be throttled/locked-out etc. But what about the web publishing logins (Web-Deploy, ...
0
votes
2answers
782 views

User Account Guessing [duplicate]

I'm doing some research on user account guessing, and wanted to ask a question about some "bad practices". My thought is generally this is a trade-off between great user functionality/UX and security....
0
votes
2answers
469 views

Showing CAPTCHA

I'd like to show a CAPTCHA to prevent brute forcing attempts, but I was thinking of showing it whenever a user fails for an invalid username/password combination after X attempts, regardless of ...
0
votes
1answer
95 views

Find hash-function if original and hash are given? [duplicate]

I was thinking whether or not you can find the hash function(s) used if you have the original message and the hash. So assume that no salt is used during the hashing process, just multiple hashing and ...
0
votes
1answer
55 views

Does restarting an encrypted session increase security and deter attacks?

When a user initiates a SSH connection for example, keys are exchanged and a session is established with a new "passphrase" each time. If an attacker were to attempt to brute force this connection, ...
0
votes
0answers
54 views

How long will it take to crack a hashed random string

If I generate 128 bit, 512 bit and 1024 bit random strings using either: A native rand() function (C, PHP, Python, etc) OpenSSL random bytes Hardware generated random number And hash the random ...
0
votes
0answers
19 views

Does the Loginizer WordPress plugin also limit XML-RPC-calls?

I learned about about XML-RPC and specifically XML-RPC in WordPress. Now, the safety of XML-RPC in WordPress this is disputed. But given, that I would like to continue using XML-RPC, in the most save ...
0
votes
0answers
27 views

PEAP MS-CHAPv2 brute force attack

I have a 802.1x switch and a client authenticated using PEAP-MS-CHAPv2. I sniffed the traffic using a HUB between the client and the switch. How can I use the captured informations to perform a brute-...
0
votes
0answers
24 views

How secure will it be to use “Google Docs long url” like authentication scheme for orders in my online shop? [duplicate]

For the sake of simplicity, instead of full-fledged authentication with login and password, I want to create "Google Docs long url" authentication scheme for my internet shop for the users. To let ...
0
votes
1answer
64 views

How to create combinations of a password [duplicate]

I don't remember my password, I can't remember exactly the variation. How can I brute force all the permutations of a word knowing the following conditions: Idea of the word (in my mind). Lower and/...
0
votes
1answer
390 views

Using THC Hydra to attack Cisco router

I am trying to do successfull attack on my cisco home router using THC Hydra. I already know a username/password(admin/admin). First with nmap I looked for open ports on router and only opened one ...
0
votes
1answer
212 views

What are the common features to identify Brute-Force attack from Apache log file?

There are various methods to find attack patterns for different types of attacks. Apache-scalp is one such tool, but the rule set is not available to find the brute-force attack pattern via regular ...
0
votes
1answer
138 views

Program for guessing a url [duplicate]

I had an old soundcloud account where i privated one of my songs. After many years, I would like to listen to the track, but i don't remember what email was linked to the account or the password. All ...
0
votes
0answers
167 views

Can a smartphone's PIN or password be brute-forced in an offline attack?

I know of exhaustive offline dictionary and brute-force attacks against any given online account, but can the same method be applied against phones, either Android/iPhones? Or would any such attack be ...
0
votes
0answers
36 views

Generate a wordlist with strings that have no repeated characters [duplicate]

I am attempting to do this with crunch, but any method would be fine. I want to generate combinations of 6 characters in which no character is repeated. Note that I don't mean the -d function, as that ...
0
votes
0answers
45 views

How to generate a bruteforce list? [duplicate]

I need a rather long dictionary to bruteforce with, following a specific pattern: I need it to combine words using the dictionary, to up to three words. It wouldn't be case sensitive, and it would use ...
0
votes
0answers
123 views

How is a birthday attack actually performed?

I thought I understood the birthday attack until I tried to actually implement it. Either I'm implementing it wrong, or there's something wrong with my interpretation of the resulting probabilities. ...
0
votes
1answer
90 views

Question about brute force performance

I just make an SHA512 brute force programs that can do 5MH/s on my i5 3.5Ghz (4 cores) which manage to use all CPU resources. If I run the program on a 2PFLOPS hpc , How many hash can it generate per ...
0
votes
0answers
202 views

Brute forcing the Veracrypt header with THC Hydra

I was advised to brute force the Veracrypt header with THC Hydra/Cygwin, but I don't know how to do that. Any help would be appreciated.
0
votes
0answers
71 views

What can attackers do to increase the rate of attempts in a brute-force attack as the number of attempts increases?

I am aware of this post (about Moore's Law and brute-force attack). Suppose is the number of brute-force attempts, we have . What I want to ask is the following: suppose an attacker started a brute-...
0
votes
0answers
288 views

How to mask attack a sha256 hash with following information using hashcat?

I am hashcat newbie and I want to crack a hash :) The answer is 1-15 (unknown) characters and it may contain 'a-z' 'A-Z' '0-9' and '_' . (A Twitter username) How may I mask attack a hash with above ...
0
votes
1answer
1k views

Brute-Forcing DVWA login page with hydra

I'm learning how to brute force web login pages with a popular brute force tool called "Hydra". I'm using Kali Linux (VirtualBox) to do this. I've installed DVWA (Damn Vulnerable Web Application) and ...
0
votes
1answer
151 views

Database logs have multiple “Logon Login failed for user” from different IPs

Background: I have an SQL Server database running on Amazon RDS The AWS dashboard has a section for logs and whenever I check the logs I see the following: 2018-04-27 06:10:26.00 Logon Error: 18456,...
0
votes
2answers
4k views

Hydra fails with “[ERROR] target ssh://192.168.16.128:22/ does not support password authentication.”?

I've updated Kali 2.0 to newest version - it is installed using VMWare. Now, every time I use hydra to brute-force SSH, I get the following error: [ERROR] target ssh://192.168.16.128:22/ does not ...
0
votes
1answer
211 views

How to bruteforce smime.p7m key

My information security teacher gave me homework - hack smime.p7m. He said that the key is simple and bruteforce will not take much time, but I can not find a utility to do this. Maybe you know these?
0
votes
0answers
101 views

Protect unauthenticated interface from guessing attacks

I am currently encountering a publically available interface; accessible at least via web form/webviews and some stateless protocol (presumably REST). In the past this form allowed you to view your ...
0
votes
0answers
109 views

Hydra returning error: “module option must start with http”

I am trying to brute force a web login password using hydra with the below command: hydra -s 8123 -x 2:8:aA1 -t 16 -m http://192.168.1.193 http-proxy I get [ERROR] module option must start with ...
0
votes
1answer
524 views

Kali Linux Hydra question

Recently a friend of mine coded a website and he asked me to brute force it to test it HTML code of the page trying to use hydra on https://pastebin.com/D2iQXrNb (use Pastebin because I don't know ...
0
votes
1answer
1k views

How do I change my IP Address after a specific number of loops in Python? [closed]

I have a for loop to brute force a Gmail account. But I've heard that Gmail's max attempts is 100. So how do I change my IP after 100 loops? Thanks in advance.
0
votes
1answer
66 views

Attacking encrypted storage vs attacking memory [duplicate]

I want to create a generative password manager. Generative password managers generate passwords based on seeds such as the master password and the website's URL. In contrast, most password managers ...
0
votes
1answer
1k views

Test a known list of possible Windows Remote Desktop credentials?

I've forgotten my password to my home server. It's a new Windows 2012R2 VM, I didn't change the maximum password age requirements in Group Policy DC (even tho I know I should have) until it was too ...
0
votes
0answers
244 views

Would it take long to brute force a md5 hash like this?

1be8917510-36.51929856278002 10bce1af27-99.18403192423284 103fa11cc6-87.21158325206488 Few examples above and as you can see the pattern is: 1xxxxxxxxx-{a percentage (0-100) to 14 decimal places} x ...
0
votes
0answers
55 views

hydra password penetration test syntax [duplicate]

I am trying to penetrate a password on my own website using hydra. Let's say that I know login and password and i just put both there like in sample below: hydra -l admin -p password 123.123.123.123 ...
0
votes
0answers
228 views

Is the password “Z” more secure than the password “a”? [duplicate]

Okay, I guess it's not possible to call one-letter-passwords "secure" - so let's compare ZZZZZZZZZZ with aaaaaaaaaa. Both are using the same character pool [A-z], so the number of combinations for a ...
0
votes
0answers
41 views

How can I determine the encryption used by knowing input and result? [duplicate]

Is it possible to determine the encryption or hash used if I know the original input and final output? There is a similar post here: Determine encoding/hashing methods used based on knowing the input ...
0
votes
2answers
430 views

Brute-force attack to exe file [closed]

I have an encrypted file and the program.exe through which it was encrypted. When I want decrypt file, I need to know the password with which the file was encrypted. Can you help me some tool for ...
-1
votes
7answers
3k views

Are passwords made up from concatenating a few foreign words better than shorter random characters? [duplicate]

Does it make sense to insert a foreign word into a paraphrase to mitigate against brute force? For example: "pussiMeansCatInEskimo" "caballoMeansHorse" "CatIsGatto" "SalopeMeansBitch" "...
-1
votes
1answer
781 views

Can brute force or dictionary attacks be detected when using the WiFi protocol?

Can the WiFi protocol recognize when a brute force or dictionary attack on it is occurring? WiFi gives the user an authentication failed message after entering an incorrect WiFi password several times....
-1
votes
3answers
6k views

Hydra producing fake login passwords

I'm trying to "hack" (login) into my own HTTPS website account through Hydra. Therefore, it is 100% legal. Hydra keeps producing tons of incorrect passwords. This is the code I use: hydra -v -V -l ...
-1
votes
1answer
588 views

How do I find out how long a password is for a 7zip aes 256 encryption? [closed]

I lost password to a 7zip, nothing important in it. But i'll still like to access it. I heard there is a way to find out how long the password is, but I dont know how.
-1
votes
2answers
3k views

Calculating permutations of a hexadecimal character set [closed]

How long would it take to run through all permutations/combinations of a ten character set; assuming the character-set is limited to a hexadecimal alphabet? (i.e. 16 characters {0..9}{A..F}; eg. ...
-1
votes
1answer
4k views

How long does it take to crack a 100-letter long winrar password? [closed]

i´m interested in how long time it would take for a super computer dedicated to crack to crack a 100-letter long winrar password. The password contains Lowercase, Uppercase, Digits, ...
-1
votes
2answers
389 views

Limiting five letter string to only include words from dictionary in Crunch?

I am creating a word list for attacking a personal .dmg file on OS X. I'm using John the Ripper for the cracking, and Crunch to create the word list: ./crunch 13 13 abcdefghijklmnopqrstuvwxyz ...
-1
votes
1answer
1k views

How to prevent ddos and brute-force attack by restricting IP's on Wordpress website

I want to make wp-login.php and/or wp-admin accessible only from one country. If I want wp-login.php access only from USA then my approach from .htaccess is like below <Files wp-login.php> ...
-1
votes
1answer
520 views

Is there a benefit to encrypting a file multiple times? [duplicate]

If I had to store a text file with some confidential information on the cloud, would encrypting the file multiple times (say, 3) with different passwords using WinRAR (AES with a 256 bit key) provide ...
-1
votes
1answer
831 views

Where can I find good word list for MySQL 5? [closed]

I wonder where can I find good collections of dictionaries which can be used for MySQL 5 dictionary attack? I just need MySQL 5 word lists / dictionaries. I found a lot of MD5, SHA1, etc. but not ...