The Stack Overflow podcast is back! Listen to an interview with our new CEO.

Questions tagged [brute-force]

An attack using every possible input to attempt to produce the correct output. Typically the method of last resort when no weakness allows the use of a more restricted input set. E.g. trying all possible (or likely) passwords, in an attempt to guess the correct one.

Filter by
Sorted by
Tagged with
0
votes
0answers
28 views

PEAP MS-CHAPv2 brute force attack

I have a 802.1x switch and a client authenticated using PEAP-MS-CHAPv2. I sniffed the traffic using a HUB between the client and the switch. How can I use the captured informations to perform a brute-...
1
vote
1answer
3k views

OWASP ZAP bruteforce by password not username

I want to bruteforce a login page using OWASP ZAP, using two separate passwords (90 lines) and username (200 lines) files, with the bruteforce POST requests to be ordered by password like: user001:...
1
vote
0answers
55 views

Bruteforcing via port 88 on MacOS

Macos has open port 88 by default. Is it possible to check validity of the password via this port from Linux and how? If the vncserver is active, it is possible to know also the username (by ...
1
vote
0answers
27 views

How much time is needed for bruteforce kerberos/ntlm?

My question is simply how much time an attacker needs for full bruteforce on typical complexity password policy given either kerberos ticket/ as req or Ntlm transaction. This depends on the ...
0
votes
1answer
152 views

Limiting the number of duplicate character types in crunch

I'm trying to generate a password list of 10 character passwords containing only a combination of 3 - 6 numbers and 3 - 6 uppercase letters. I see option -d which allows a set limit of duplicates of ...
-1
votes
3answers
7k views

Hydra producing fake login passwords

I'm trying to "hack" (login) into my own HTTPS website account through Hydra. Therefore, it is 100% legal. Hydra keeps producing tons of incorrect passwords. This is the code I use: hydra -v -V -l ...
0
votes
2answers
345 views

How to brute force only username not password?

I want to find the username first, then pass the username and a password list. I could not find flags to ignore password in Ncrack and other related tools. The device I want to find a username is ...
9
votes
1answer
3k views

What local resources are used when bruteforcing a remote service?

What pc resources are used when bruteforcing ? I mean bruteforcing something online, not hashes. Do you need a good amount a RAM and a good CPU or it's just about the internet speed ?
2
votes
2answers
175 views

How does Window Hello protect against brute forcing?

With my Windows 10 computer, I have the option to set up a PIN with Windows Hello (I believe it's with that program). My normal Outlook password is 15+ characters mixed with upper case and lower case ...
1
vote
3answers
206 views

Disguising the type of hash used

I've read about why MD5, SHA1, and many other hashing functions are insecure, by a lot, but I'm thinking of doing a different approach. It won't increase security, I'm aware of that, but I believe it ...
2
votes
1answer
1k views

RSA-1024 vs. DSA-1024: Claim DSA SSH key is much faster to brute force

Does the brute force speed vary significantly between 1024-bit RSA and DSA SSH keys? DSA like gpu keypairs are probably DSA/Elgamal? (Can't find docs) EDIT: The reason I ask is an instructor that "...
0
votes
1answer
122 views

Generating passwords with rule: the contents within a 10 characters string must maintain a certain ratio of numbers and letters in no particular order

I'm playing around with Kali and am looking to crack my WPA2 default password. I started generating 10 character passwords with a charset of solely digits and upper alpha lastnight and after 10 mins, ...
1
vote
1answer
62 views

Postfix SMTP - Can I use SSH public keys instead of sasl password

I am relatively new to managing mail server, although i am familiar with webhosting servers not running dedicated email services. Postfix is configured to use sasl-password authentication I have ...
132
votes
10answers
261k views

Where can I find good dictionaries for dictionary attacks?

I’m wondering where I can find good collections of dictionaries which can be used for dictionary attacks? I've found some through Google, but I’m interested in hearing about where you get your ...
0
votes
2answers
301 views

Protect MySQL against brute-force attacks on dedicated CentOS 7 server

I have a database in a dedicated server (CentOS 7) setup by an external provider. I see a disgusting amount of brute-force attempts in MySQL log file every day. I know the best option would be to not ...
5
votes
1answer
326 views

Spoofing an NTP server to allow bruteforce on any smartphone

We all know that smartphones (i'll take iPhone as an example) rely on SNTP/NTP servers to update a device's time and date. So, by creating an SNTP server that mimics Apple's server, we can actually ...
1
vote
1answer
83 views

Is there any methods available other than brute force and dictionary attacks?

I am curious to know about the wifi attacks. And I have known a little bit about brute force attack and dictionary attack. Is there any other methods available other than these two...?
-1
votes
1answer
177 views

Subdomain scanner without brute-force attack? [duplicate]

It is possible to scan subdomains of network without brute-force attack? If yes, how it works? I tried to scan the network with some penetrating tools and it returned to me subdomain which doesn't ...
1
vote
2answers
279 views

BurpSuite Brute Force Iteration

I am working on a security assessment for an online application. When testing the pin verification mechanism and possibilities of brute force, I came across a post request that looks like the below ...
12
votes
4answers
4k views

Wordpress Brute Force Attacker knows real admin Username -

I've noticed a brute force attempt on several different Wordpress installs that know the right admin user name for those respective sites... It seems very strange that the hacker would be able to ...
-2
votes
2answers
665 views

How secure is aes-256-cbc with a 40 char password [closed]

I'm using this command from this article to encrypt a file: openssl enc -aes-256-cbc -in /etc/services -out services.dat -k MYPASSWORD If MYPASSWORD is 40 characters in length, roughly how long ...
1
vote
1answer
113 views

Is it possible to prevent WiFi password brute-forcing?

Are there any measures I can set, except using a better password, to prevent someone brute-forcing a WiFi password?
7
votes
3answers
1k views

Can using emojis make someone's password safer?

I was just thinking about this the other day, after reading about making safe passwords, you have a few options: The first would be, adding numbers, or something other than just a word ...
0
votes
0answers
24 views

How secure will it be to use “Google Docs long url” like authentication scheme for orders in my online shop? [duplicate]

For the sake of simplicity, instead of full-fledged authentication with login and password, I want to create "Google Docs long url" authentication scheme for my internet shop for the users. To let ...
0
votes
1answer
112 views

Question about birthday attack on password

Based on birthday attack, you need to generate at least 2^n/2 of possible combination to have 50% chance of finding a password. I have a list of 3000 random password make from 16 characters of upper, ...
10
votes
3answers
7k views

Session Hijacking through sessionId brute-forcing possible?

cookies usually contain a sessionId to keep track of a logged user. What would prevent a malicious user to forge millions of requests with random sessionIds and send them to a server, hoping to ...
3
votes
1answer
102 views

Why does Authenticated Encryption not decrease confidentiality?

Recently, another question here made me start thinking about authenticated encryption. In my understanding AE allows to check whether a key is valid for decryption without even decrypting the ...
5
votes
2answers
4k views

Do you need more than 128-bit entropy?

UUID uses 128-bit numbers. Currently it is not feasible to randomly produce two UUIDs that are the same. Does that mean 128 bits of entropy is suitable for all cryptographic operations? I would ...
6
votes
3answers
2k views

Is a password easier to brute force if it contains a repeating pattern?

My question is different from this previous question: Does repeating one word to form a password result in a similar pattern in its encrypted format?. I'm specifically wondering about brute force ...
1
vote
2answers
2k views

Bruteforce Veracrypt

I forgot my Veracrypt password, I have around 1000-2000 possible password combination and I need a software to bruteforce the password on Windows. What software would that be?
0
votes
1answer
103 views

Please may I know why I am getting this Sshd log

why I am getting this sshd log Feb 1 13:07:57 sshd[6453]: Failed password for root from 193.34.22.63 port 28980 ssh2 Feb 1 13:08:26 sshd[6897]: Failed password for root from 91.205.189.15 port 48155 ...
0
votes
1answer
73 views

How to create combinations of a password [duplicate]

I don't remember my password, I can't remember exactly the variation. How can I brute force all the permutations of a word knowing the following conditions: Idea of the word (in my mind). Lower and/...
0
votes
3answers
261 views

How often do brute force attacks find the password or key in a much shorter amount of time than the theoretical max?

For a 128-bit key, it would theoretically take many years and a percentage of the entire worlds power output to check every possible key, or for 256-bit it would take 3 sexdecillion years. But the ...
0
votes
1answer
645 views

Using THC Hydra to attack Cisco router

I am trying to do successfull attack on my cisco home router using THC Hydra. I already know a username/password(admin/admin). First with nmap I looked for open ports on router and only opened one ...
0
votes
1answer
237 views

Program for guessing a url [duplicate]

I had an old soundcloud account where i privated one of my songs. After many years, I would like to listen to the track, but i don't remember what email was linked to the account or the password. All ...
0
votes
0answers
315 views

Can a smartphone's PIN or password be brute-forced in an offline attack?

I know of exhaustive offline dictionary and brute-force attacks against any given online account, but can the same method be applied against phones, either Android/iPhones? Or would any such attack be ...
0
votes
1answer
89 views

How do these attackers find my IP? [duplicate]

Recently, I have been reading a lot of my ubuntu log files (in /var/log/auth.log), and I can see that some IP addresses are actually trying to 'brute-force' their ways into my VM using SSH by testing ...
93
votes
7answers
13k views

Script Kiddies - how do they find my server IP?

I've set up a site on Digital Ocean without a domain yet, so there is only the IP. Despite telling no-one of its existence or advertising it, I get hundreds of notices from fail2ban that various IP's ...
27
votes
1answer
10k views

How does the attacker know what algorithm and salt to use in a dictionary attack?

I am curious about password cracking methods like dictionary and brute force attacks. Nowadays passwords are stored as hashes and not plaintext on the server. Then how can the plaintext passwords in ...
0
votes
1answer
2k views

THC Hydra on Windows RDP Domain

I am testing a bruteforce on a windows rdp server within a domain. It seems to not be working because nothing is locking out the account I am targeting. How do you specify a domain username? I tried ...
2
votes
3answers
198 views

Encryption Key vs. One-Time Pad Brute Force

How does an attacker know when they've cracked a traditional encryption key? Wikipedia describes the one-time pad: A 140 character one-time-pad-encoded string subjected to a brute-force attack ...
-3
votes
1answer
146 views

How long would it take to brute force a URL path that's 5 characters long

example.com/[a-zA-Z0-9] the code can be any mix of numbers + uppercase/lowercase letters and it's 5 characters. How long would it take to brute force or is there an easier/faster way to do it?
0
votes
0answers
38 views

Generate a wordlist with strings that have no repeated characters [duplicate]

I am attempting to do this with crunch, but any method would be fine. I want to generate combinations of 6 characters in which no character is repeated. Note that I don't mean the -d function, as that ...
0
votes
0answers
46 views

How to generate a bruteforce list? [duplicate]

I need a rather long dictionary to bruteforce with, following a specific pattern: I need it to combine words using the dictionary, to up to three words. It wouldn't be case sensitive, and it would use ...
0
votes
1answer
647 views

Brute force MD5 with a prefix and suffix up to n characters/words

I have a couple of things I would like to explore with hashcat. I have a MD5 hashed password, which I know for a fact has a prefix and a suffix. The actual password is located in the middle of the ...
0
votes
1answer
274 views

Using hashcat for collision attack [closed]

Whenever i tried generate √N randomly(possible combinations of password length), i always find few collisons of the hash password no matter the length, if the password was made of entirely random ...
15
votes
5answers
127k views

Bruteforce on 10 characters length WPA2 password

I'm trying to hack my own WPA2 network for learning purposes. I have the *.cap file generated by aircrack-ng tools after a WPA handshake. I've tested by including my own password and a bunch of ...
2
votes
1answer
203 views

What is the fastest way to brute force a hardware code

Where I live, there is a keypad with numbers from 0 to 9 and two letters, A and B. Using it I noticed that the code was checked on the last 5 things entered. If I were to try every code on the keypad,...
0
votes
0answers
141 views

How is a birthday attack actually performed?

I thought I understood the birthday attack until I tried to actually implement it. Either I'm implementing it wrong, or there's something wrong with my interpretation of the resulting probabilities. ...
0
votes
0answers
223 views

Brute forcing the Veracrypt header with THC Hydra

I was advised to brute force the Veracrypt header with THC Hydra/Cygwin, but I don't know how to do that. Any help would be appreciated.