Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [brute-force]

An attack using every possible input to attempt to produce the correct output. Typically the method of last resort when no weakness allows the use of a more restricted input set. E.g. trying all possible (or likely) passwords, in an attempt to guess the correct one.

8
votes
3answers
3k views

NTLMv2 resistance to bruteforcing

I have a question regarding NTLMv2 resistance to password bruteforcing. I know that some modern graphic processors (like Radeon 6990) are able to calculate billions hashes per second and crack NTLM ...
8
votes
1answer
720 views

SSH Brute Force Dictionaries

Request for logs please. So, I had an interesting question posed to me around geographical trends in SSH brute force attempts. The question being "has anybody ever looked into the prevalent SSH ...
8
votes
1answer
2k views

Hydra when redirects

I'm using Hydra and I have trouble with this command: hydra 123.123.123.123 http-form-post \ "/se/login:j_username^USER^&j_password=^PASS^&submit=Log+in:/se/invalidLogin" \ -L /root/...
8
votes
2answers
577 views

Do I REALLY need to change my LastPass password?

Last weekend LastPass' network was compromised and that a list of email addresses along with the hashes of the master passwords were stolen. It is being recommended that LastPass users change their ...
7
votes
3answers
4k views

Why is it harder to brute force an iphone than a zip-file?

Having only 1,000,000 possible combinations, an encrypted zip-file with a 6-digit numeric password, could be brute force cracked within a second. But for an iphone (let's say iOS9 if it matters), it ...
7
votes
3answers
4k views

Safety of Password Hashing Using bcrypt Done on Client Side

I am currently using a technique where I send the username/password in cleartext (using https) to the server, which then does bcrypt and compares to the db. Standard practice. It is considered safe. ...
7
votes
3answers
1k views

It is possible that brute force attempts are successful before the worst case, correct?

When I read about a password being secure and stating that it would take X amount of week, years, etc. isn't that referring to the worst case? What happens if the brute force method is successul in ...
7
votes
3answers
2k views

Why do we have such big keys?

In Chapter 7 of Applied Cryptography, Bruce Schneier claims that, due to thermodynamic limitations, "brute-force attacks against 256-bit [symmetric] keys will be infeasible until computers are built ...
7
votes
4answers
8k views

Calculate time taken to break AES key

A 256 bit AES key is required to be broken using the brute force method on a 2GHz computer. How long would it take to break the key in the best case and in the worst case situations? Assume that 1000 ...
7
votes
2answers
11k views

How long would it take to brute force an 11 character single-case alphanumeric password?

My previous home wifi router's WPA2 password was permanently fixed to FZ4HBCKHGC8. How long would it take to crack via brute force? Or more pragmatically: How long would it take to exhaust all ...
7
votes
5answers
56k views

How long would it take to bruteforce an AES-128 protected pdf knowing the key is 20 letter long and that the charset is A-Z,0-9?

The question says everything, knowing that a pdf is protected using standard Adobe password encryption that comes with Acrobat Pro (which as far as i know is AES 128) how much would it take to ...
7
votes
4answers
4k views

Are there lists of most common words or ngrams used in passwords and passphrases?

I've been thinking about ways to focus brute forcing dictionary attacks on passwords and passphrases based on the assumption that certain words, combinations of letters, and combinations of words are ...
7
votes
2answers
3k views

Dictionary Attack on Wifi

I know a few people with pretty weak passwords. What kind of systems exist to prevent dictionary attacks? Would it make sense to restrict the number of connection attempts in a certain timeframe? ...
7
votes
3answers
5k views

Which is faster - brute-forcing, or using a dictionary attack that contains all possible permutations?

Assuming a 6-character password uses the mixalphanumeric charset, giving each character a character set of 62 and the entire password a keyspace of 62^6 = 46.6 billion (if my calculations are correct)....
7
votes
3answers
3k views

Known Password Lengths and security considerations [duplicate]

Many people wil often brag about the length of their password, like "yeah nobody is ever going to crack my password cause its 22 characters long." I was thinking, if you knew the exact length of their ...
7
votes
3answers
1k views

Can using emojis make someone's password safer?

I was just thinking about this the other day, after reading about making safe passwords, you have a few options: The first would be, adding numbers, or something other than just a word ...
7
votes
4answers
5k views

Throttling failed login attempts: exponential timeout? by IP? using a session cookie? captcha?

I'm beginning to think this is not as simple as it looks, and many "accepted" answers here and in SO have alternative answers that criticize them. Here is what I have gathered so far Most of what I ...
7
votes
1answer
2k views

Brute force login attempt from spoofed IP's

I see that many of my WordPress installs are being hit with 1000+ failed login attempts using non-existing 'admin' account name. The requests come from different IP's every time, and I see IP's such ...
7
votes
1answer
5k views

Passphrase vs. password entropy

For a while now I have been interested in the passphrase concept as a potentially more secure replacement for classical passwords. My interest stemmed from a gut feeling that passphrases would be of a ...
7
votes
1answer
2k views

How resistant is the iPhone encryption against brute-force attacks?

I just read the following paragraph in an article from the New York Times about Apple encrypting iPhones by default): Breaking the code, according to an Apple technical guide, could take “more than ...
7
votes
2answers
13k views

Estimated cost to make a brute-force WPA2 attack feasible

It's been shown that a brute-force attack on WPA2-Personal is possible in a reasonable amount of time. These successful attacks appear to be limited, however, to researchers who have the budget to ...
7
votes
1answer
11k views

Bruteforce with hashcat, how to set the mask properly?

Let's say I've an hash of this type: test::::4e45c7bab093d7011e9b3a5df7d9fa88212beac5ac9c8c47:d6ff3373aa353f3b:123456 I would like to bruteforce it using hashcat, but I'm failing to set the correct ...
7
votes
2answers
703 views

Is there an equivalent of an Apple cryptochip in Android devices?

Apple has a cryptochip which, beside managing the encryption keys, tunnels authentication and provides throttling of failed attempts, as well as the ability to trigger a device wipe after several ...
7
votes
4answers
6k views

Can I brute-force a password hash even if I don't know the hash-algorithm used?

Can I brute-force a password hash even if I don't know the underlying algorithm? For example if I get hold of a database with password hashes and the used hash algorithm is unknown, like a random ...
7
votes
1answer
430 views

Brute forcing encryption password (self destruct after 4 attempts)

My colleague at work lost the password to his external hard drive (HDD not SSD), a WD Elements. He remembers that his password was simple and 8 characters maximum. The problem is the encryption ...
6
votes
4answers
46k views

Brute-force an SSH-login that has only a 4-letter password

Suppose, you know that a certain computer is only protected by such a short password, then you could just try every possible combination easily. How would a script look like, that tries to crack that ...
6
votes
5answers
2k views

What password cracking software is commonly used?

I am curious to know how secure my passwords are. What password cracking software is commonly used? Preferably open source. EDIT: I am actually looking to crack my passwords used on services I don'...
6
votes
3answers
508 views

How much added security do I really get with a longer key size?

Imagine I have a cipher which supports keys of 128, 192 or 256 bits. Suppose that there are no vulnerabilities in the cipher regardless of key length. I'm going to use it to encrypt something, and I'...
6
votes
2answers
13k views

Can DES-based hashed password be recovered if salt is known?

Can a hashed password be recovered if the hashing is done with DES based crypt function in PHP and both the hash and salt are known by the attacker? Consider the following example: $salt = 'mysalt'; ...
6
votes
3answers
2k views

Is a password easier to brute force if it contains a repeating pattern?

My question is different from this previous question: Does repeating one word to form a password result in a similar pattern in its encrypted format?. I'm specifically wondering about brute force ...
6
votes
4answers
1k views

Can't brute force password cracking somehow be throttled?

Online articles mention the importance of a strong password and suggest that hacking tools allows bad guys to attempt millions of passwords per second. I am wondering why OSes and websites and such ...
6
votes
3answers
3k views

How can i calculate the number of possible passwords?

I have found a flaw in a site where the password reset feature resets passwords in the following format UpperCaseLetter-Number-LowerCaseLetter-Number-LowerCaseLetter-Number-UpperCaseLetter Eg: ...
6
votes
2answers
41k views

Is it possible to crack a PIN / PUK code on a phone SIM card?

When deploying a mobile phone best practices policy, one of the points which were raised was the requirement for the user to protect his SIM card with a PIN. The theory is that three failed attempts ...
6
votes
4answers
3k views

Brute-force heuristics used in password cracking

Existing questions on this site discuss some of the heuristics used by password cracking tools to avoid doing a completely naive brute-force search (for example, "dictionary word with number ...
6
votes
1answer
2k views

How secure is Scrypt, really?

I've been recently taking a hard look at the scrypt system for storing users' passwords. However, I'm rather worried about it's security because of things like Litecoin miners. Is scrypt secure ...
6
votes
3answers
14k views

How can Facebook possibly stop a bruteforce attack on an account?

I've been doing some research on hacking recently and I found some very interesting tutorials on brute force cracking. I have some questions to ask and I'll be using Facebook as an example. Let's say ...
6
votes
2answers
453 views

is it easier to get the original password if you have multiple hashes of it?

Most users tipically use the same password for multiple applications. Let's say all of these applications hash the password in some way. Would it be easier for an attacker to get the original password ...
6
votes
2answers
7k views

Cracking a JWT signature

I am testing an API that uses JWT for authentication. This JWT has a HS256 signature to prevent modification. I figured that if I determine the secret key used in this signature, I can create my own ...
6
votes
2answers
2k views

Apple vs DOJ - how strong is the 10-try wipe brute force barrier?

Out of curiosity and with the hope of helping other beginners and journalists. The current Apple vs DOJ standoff in a nutshell - Apple is resisting DOJ with statements like what they're asking is "...
6
votes
2answers
4k views

How can we protect signup APIs from brute force registration?

This is a general question but its prompted by a fairly open API I have for a file storage service that needs to have its front door better locked down. We have an API like POST '/signup' that just ...
6
votes
1answer
6k views

Are these access.log entries successful wordpress login attempts?

I am hosting some wordpress sites on an apache 2.4 webserver, and I have discovered thousands of entries in my server logs like this: 221.219.219.248 - - [09/Mar/2015:03:29:25 +1300] "GET /example....
6
votes
1answer
2k views

How secure is a Windows 10 PIN not needing enter?

I've searched around about Windows 10 PINs and although have seen a few answers regarding the security of them as a whole, I haven't found any discussing the fact that when I type in my PIN, the ...
6
votes
3answers
340 views

How do I secure my advertisement space against ad overlay browser attachments?

I don't really have an issue with advertisements simply being blocked by individual users who are visiting a customers site or my own site. As an individual you have the freedom to choose not to look ...
5
votes
8answers
2k views

Does it take longer to brute force a password starting with z than one starting with a?

I was wondering about the following: If someone tries to get my password with Brute Force, will a password starting with "a" guessed faster than one starting with "z" ? In this case assume the ...
5
votes
3answers
1k views

Perfectly Robust Hashing Scheme, or Completely Over-Engineered?

This is going to get long, so prepare. Basis of the question is, Do all these steps improve security, or am I completely overthinking the problem? Are my assumptions/thought process valid? We all ...
5
votes
4answers
9k views

Finding all links under a website

How can i find all directories and links under a website? Note that there is no link from home page to all other pages. For example if i have a domain like this users.company.com and each user will ...
5
votes
4answers
237 views

software to keep a list of IP that try to access ssh over a set of rules and feasibility

i'm interested in software or set of scripts to keep a lists of filtered IP that attempt to brute-force ssh, and to label an IP as brute-forcing i would add some checks like: one attempt to log as ...
5
votes
4answers
6k views

Brute force vs other methods of recovering passwords from shadow file

Do you know any good approach for de-hashing/actually bruteforcing hashed passwords in the shadow file? On various operating systems, any good solutions/methods/programs. Or is it better to upload ...
5
votes
3answers
6k views

What are the odds of brute-forcing an archive with 256-bit encryption?

I have a file (a stand-alone archive). I lost the password to it, but it has been encrypted using 256-bit encryption. The password is some 20-odd characters long (including non-alphanumeric ...
5
votes
3answers
6k views

Avoiding Brute Force Attacks in a Web Based Login Form

My login form uses Ajax so it doesn't need to reload if the password is wrong. A PHP script process the request and creates the session if the credentials are right. My idea is to have the PHP script ...