Questions tagged [brute-force]

An attack using every possible input to attempt to produce the correct output. Typically the method of last resort when no weakness allows the use of a more restricted input set. E.g. trying all possible (or likely) passwords, in an attempt to guess the correct one.

Filter by
Sorted by
Tagged with
-4
votes
1answer
89 views

Binary Numbers converted to Hexadecimal private key [on hold]

Couldn't you use brute force to guess someone’s binary number because it's 1 or 0 - 256 times then just keep switching 1's and 0's around- which then can be converted hexadecimal to guess their ...
0
votes
0answers
16 views

Password checking implementation: delay on unsuccessful attempts [duplicate]

What would be wrong with the username/password checker where the response is instantaneous for valid attempts but a pre-built time delay (say 1 sec) is used for unsuccessful ones? It would not slow ...
3
votes
1answer
189 views

How secure is KeePass KDBX4 by default? [on hold]

How secure is KeePass KDBX4 by default if someone obtain the .kdbx file and attempt to brute-force it without knowing any hint of the master password? With assumption : The password length is equal/...
0
votes
1answer
27 views

NCrack bruteforcing for http-get using -iL options

How to do NCrack bruteforcing for http-get service using -iL (mass scan) options where server is having different port.
0
votes
0answers
44 views

Remote Desktop compromised

So roughly 2 weeks ago my Remote Desktop was compromised whilst I was actively interacting with my server via Rdp I was prompted with a disconnect status equal to “ Another user has connected to ...
7
votes
1answer
129 views

TOTP brute force prevention

Lets use Google Authenticator as example. A 6 digit code is generated every 30 second. Each random attempt has 1/1,000,000 chance of success. Server will usually accept code of ±30s which increased ...
1
vote
0answers
46 views

Preventing Linux brute force concurrent su/sudo attempts

Its well known that popular Linux distros use the PAM default to slightly delay incorrect login attempts, thus mitigating brute-force attacks against a user account (for example, running su repeatedly ...
0
votes
0answers
55 views

How long will it take to crack a hashed random string

If I generate 128 bit, 512 bit and 1024 bit random strings using either: A native rand() function (C, PHP, Python, etc) OpenSSL random bytes Hardware generated random number And hash the random ...
2
votes
3answers
118 views

Terminology for reduced brute-force attack?

Many security algorithms today have such a large key length, that there's just no use in trying to brute-force a key. For example to find one AES-256 key you would have to try 2^255 keys on average. ...
0
votes
0answers
20 views

Does the Loginizer WordPress plugin also limit XML-RPC-calls?

I learned about about XML-RPC and specifically XML-RPC in WordPress. Now, the safety of XML-RPC in WordPress this is disputed. But given, that I would like to continue using XML-RPC, in the most save ...
0
votes
0answers
27 views

PEAP MS-CHAPv2 brute force attack

I have a 802.1x switch and a client authenticated using PEAP-MS-CHAPv2. I sniffed the traffic using a HUB between the client and the switch. How can I use the captured informations to perform a brute-...
1
vote
1answer
88 views

Centralized brute force login detection using netflow data

Is brute force login detection feasible with netflow data? With the netflow data one could check the number of incoming packets to a specific destination port (for each flow). If the number is below a ...
1
vote
0answers
50 views

Bruteforcing via port 88 on MacOS

Macos has open port 88 by default. Is it possible to check validity of the password via this port from Linux and how? If the vncserver is active, it is possible to know also the username (by ...
22
votes
2answers
7k views

Do Veracrypt encrypted volumes have any kind of brute force protection?

I have a 10mb encrypted volume which I made with Veracrypt and was planning to upload it to the internet. I have a pretty strong password but was worried about its protection against brute force ...
1
vote
0answers
26 views

How much time is needed for bruteforce kerberos/ntlm?

My question is simply how much time an attacker needs for full bruteforce on typical complexity password policy given either kerberos ticket/ as req or Ntlm transaction. This depends on the ...
2
votes
2answers
169 views

How does Window Hello protect against brute forcing?

With my Windows 10 computer, I have the option to set up a PIN with Windows Hello (I believe it's with that program). My normal Outlook password is 15+ characters mixed with upper case and lower case ...
1
vote
3answers
197 views

Disguising the type of hash used

I've read about why MD5, SHA1, and many other hashing functions are insecure, by a lot, but I'm thinking of doing a different approach. It won't increase security, I'm aware of that, but I believe it ...
9
votes
1answer
3k views

What local resources are used when bruteforcing a remote service?

What pc resources are used when bruteforcing ? I mean bruteforcing something online, not hashes. Do you need a good amount a RAM and a good CPU or it's just about the internet speed ?
1
vote
1answer
47 views

Postfix SMTP - Can I use SSH public keys instead of sasl password

I am relatively new to managing mail server, although i am familiar with webhosting servers not running dedicated email services. Postfix is configured to use sasl-password authentication I have ...
0
votes
1answer
106 views

Limiting the number of duplicate character types in crunch

I'm trying to generate a password list of 10 character passwords containing only a combination of 3 - 6 numbers and 3 - 6 uppercase letters. I see option -d which allows a set limit of duplicates of ...
0
votes
1answer
119 views

Generating passwords with rule: the contents within a 10 characters string must maintain a certain ratio of numbers and letters in no particular order

I'm playing around with Kali and am looking to crack my WPA2 default password. I started generating 10 character passwords with a charset of solely digits and upper alpha lastnight and after 10 mins, ...
1
vote
1answer
77 views

Is there any methods available other than brute force and dictionary attacks?

I am curious to know about the wifi attacks. And I have known a little bit about brute force attack and dictionary attack. Is there any other methods available other than these two...?
0
votes
2answers
238 views

How to brute force only username not password?

I want to find the username first, then pass the username and a password list. I could not find flags to ignore password in Ncrack and other related tools. The device I want to find a username is ...
-1
votes
1answer
133 views

Subdomain scanner without brute-force attack? [duplicate]

It is possible to scan subdomains of network without brute-force attack? If yes, how it works? I tried to scan the network with some penetrating tools and it returned to me subdomain which doesn't ...
1
vote
2answers
210 views

BurpSuite Brute Force Iteration

I am working on a security assessment for an online application. When testing the pin verification mechanism and possibilities of brute force, I came across a post request that looks like the below ...
1
vote
1answer
110 views

Is it possible to prevent WiFi password brute-forcing?

Are there any measures I can set, except using a better password, to prevent someone brute-forcing a WiFi password?
0
votes
0answers
24 views

How secure will it be to use “Google Docs long url” like authentication scheme for orders in my online shop? [duplicate]

For the sake of simplicity, instead of full-fledged authentication with login and password, I want to create "Google Docs long url" authentication scheme for my internet shop for the users. To let ...
0
votes
1answer
105 views

Question about birthday attack on password

Based on birthday attack, you need to generate at least 2^n/2 of possible combination to have 50% chance of finding a password. I have a list of 3000 random password make from 16 characters of upper, ...
3
votes
1answer
99 views

Why does Authenticated Encryption not decrease confidentiality?

Recently, another question here made me start thinking about authenticated encryption. In my understanding AE allows to check whether a key is valid for decryption without even decrypting the ...
1
vote
2answers
1k views

Bruteforce Veracrypt

I forgot my Veracrypt password, I have around 1000-2000 possible password combination and I need a software to bruteforce the password on Windows. What software would that be?
0
votes
1answer
72 views

Please may I know why I am getting this Sshd log

why I am getting this sshd log Feb 1 13:07:57 sshd[6453]: Failed password for root from 193.34.22.63 port 28980 ssh2 Feb 1 13:08:26 sshd[6897]: Failed password for root from 91.205.189.15 port 48155 ...
0
votes
1answer
67 views

How to create combinations of a password [duplicate]

I don't remember my password, I can't remember exactly the variation. How can I brute force all the permutations of a word knowing the following conditions: Idea of the word (in my mind). Lower and/...
0
votes
3answers
250 views

How often do brute force attacks find the password or key in a much shorter amount of time than the theoretical max?

For a 128-bit key, it would theoretically take many years and a percentage of the entire worlds power output to check every possible key, or for 256-bit it would take 3 sexdecillion years. But the ...
0
votes
1answer
480 views

Using THC Hydra to attack Cisco router

I am trying to do successfull attack on my cisco home router using THC Hydra. I already know a username/password(admin/admin). First with nmap I looked for open ports on router and only opened one ...
0
votes
1answer
230 views

What are the common features to identify Brute-Force attack from Apache log file?

There are various methods to find attack patterns for different types of attacks. Apache-scalp is one such tool, but the rule set is not available to find the brute-force attack pattern via regular ...
0
votes
1answer
169 views

Program for guessing a url [duplicate]

I had an old soundcloud account where i privated one of my songs. After many years, I would like to listen to the track, but i don't remember what email was linked to the account or the password. All ...
1
vote
1answer
202 views

Windows server 2016 Remote Desktop username leaked

One of our servers got infected with ransomware last week (Matrix, .Grhan). The server allowed remote desktop connection from outside on the default port, which was a big security hole (and also, the ...
0
votes
0answers
214 views

Can a smartphone's PIN or password be brute-forced in an offline attack?

I know of exhaustive offline dictionary and brute-force attacks against any given online account, but can the same method be applied against phones, either Android/iPhones? Or would any such attack be ...
0
votes
1answer
88 views

How do these attackers find my IP? [duplicate]

Recently, I have been reading a lot of my ubuntu log files (in /var/log/auth.log), and I can see that some IP addresses are actually trying to 'brute-force' their ways into my VM using SSH by testing ...
2
votes
3answers
149 views

Encryption Key vs. One-Time Pad Brute Force

How does an attacker know when they've cracked a traditional encryption key? Wikipedia describes the one-time pad: A 140 character one-time-pad-encoded string subjected to a brute-force attack ...
-3
votes
1answer
135 views

How long would it take to brute force a URL path that's 5 characters long

example.com/[a-zA-Z0-9] the code can be any mix of numbers + uppercase/lowercase letters and it's 5 characters. How long would it take to brute force or is there an easier/faster way to do it?
0
votes
0answers
37 views

Generate a wordlist with strings that have no repeated characters [duplicate]

I am attempting to do this with crunch, but any method would be fine. I want to generate combinations of 6 characters in which no character is repeated. Note that I don't mean the -d function, as that ...
0
votes
0answers
45 views

How to generate a bruteforce list? [duplicate]

I need a rather long dictionary to bruteforce with, following a specific pattern: I need it to combine words using the dictionary, to up to three words. It wouldn't be case sensitive, and it would use ...
0
votes
1answer
230 views

Using hashcat for collision attack [closed]

Whenever i tried generate √N randomly(possible combinations of password length), i always find few collisons of the hash password no matter the length, if the password was made of entirely random ...
2
votes
1answer
199 views

What is the fastest way to brute force a hardware code

Where I live, there is a keypad with numbers from 0 to 9 and two letters, A and B. Using it I noticed that the code was checked on the last 5 things entered. If I were to try every code on the keypad,...
0
votes
0answers
128 views

How is a birthday attack actually performed?

I thought I understood the birthday attack until I tried to actually implement it. Either I'm implementing it wrong, or there's something wrong with my interpretation of the resulting probabilities. ...
0
votes
1answer
91 views

Question about brute force performance

I just make an SHA512 brute force programs that can do 5MH/s on my i5 3.5Ghz (4 cores) which manage to use all CPU resources. If I run the program on a 2PFLOPS hpc , How many hash can it generate per ...
0
votes
0answers
213 views

Brute forcing the Veracrypt header with THC Hydra

I was advised to brute force the Veracrypt header with THC Hydra/Cygwin, but I don't know how to do that. Any help would be appreciated.
1
vote
1answer
96 views

Partially forgotten encryption password for Windows users [duplicate]

I encrypted important files with Veracrypt and I remember most of the password but some parts are forgotten. I need some advice as to what would be the most efficient way of getting the encryption ...
0
votes
1answer
523 views

Brute force MD5 with a prefix and suffix up to n characters/words

I have a couple of things I would like to explore with hashcat. I have a MD5 hashed password, which I know for a fact has a prefix and a suffix. The actual password is located in the middle of the ...