Episode #125 of the Stack Overflow podcast is here. We talk Tilde Club and mechanical keyboards. Listen now

Questions tagged [brute-force]

An attack using every possible input to attempt to produce the correct output. Typically the method of last resort when no weakness allows the use of a more restricted input set. E.g. trying all possible (or likely) passwords, in an attempt to guess the correct one.

Filter by
Sorted by
Tagged with
0
votes
1answer
862 views

Which hashcat hash mode is closest to that used by BitLocker?

I'm trying to get a hypothetical benchmark for the BitLocker hash mode if Hashcat would support it. Which (-m) mode is closest to BitLocker's latest/default algorithm? From Google searches I learned ...
8
votes
1answer
6k views

Passphrase vs. password entropy

For a while now I have been interested in the passphrase concept as a potentially more secure replacement for classical passwords. My interest stemmed from a gut feeling that passphrases would be of a ...
0
votes
1answer
823 views

Avoid brute force attacks on oAuth authorization server

I've been looking into the oAuth 2 authorization framework for a while now. Yesterday I started wondering how to prevent a brute force attack during the Authorization Code Grant flow (https://tools....
92
votes
8answers
16k views

Can secret GET requests be brute forced? [duplicate]

Say, I have on my server a page or folder which I want to be secret. example.com/fdsafdsafdsfdsfdsafdrewrew.html or example.com/fdsafdsafdsfdsfdsafdrewrewaa34532543432/admin/index.html If the ...
1
vote
0answers
347 views

How to recover forgotten AES-256 password with bruce force?

The password was set on a flash drive using LaCie Private-Public for Windows 10. The password is 12 character long. For each character, I know if it is a number, special character, lower case letter ...
5
votes
1answer
370 views

Can passwords be brute-forced through RDP?

We had a small discussion about a security-related article at work today, and I was a bit surprised about one thing - they claim that some attackers managed to brute-force guess the password of ...
7
votes
5answers
57k views

How long would it take to bruteforce an AES-128 protected pdf knowing the key is 20 letter long and that the charset is A-Z,0-9?

The question says everything, knowing that a pdf is protected using standard Adobe password encryption that comes with Acrobat Pro (which as far as i know is AES 128) how much would it take to ...
5
votes
3answers
4k views

How to protect our server from brute force attack? [closed]

One of the most common cyber attack is Bruteforce , what are the mechanisms available to protect this attack and how industry apply these mechanisms to mitigate the attacks (best practices)?
4
votes
1answer
378 views

Wireshark HTTP continuations (Hydra HTTP version)

I am trying to use Hydra to brute force a HTTP POST form page, however the page is returning a HTTP Continuation I'm not sure what that is. This is being caused by the HTTP/1.0 at the top of the ...
5
votes
2answers
511 views

Is there a way to see what is program is causing RDP attempts on computer

One of our servers (running RdpGuard) shows multiple failed attempts from specific users' machines (3 to be exact) and I can't figure out what is causing them. One user is local and two are remote ...
5
votes
4answers
2k views

Hashing a key: less entropy than the key itself

A web API needs to store a 'key' for authentication, in much the same fashion as a password but at 128 characters. My concern is that the salted SHA1 hash for the key has less entropy than the key ...
-1
votes
1answer
888 views

Can brute force or dictionary attacks be detected when using the WiFi protocol?

Can the WiFi protocol recognize when a brute force or dictionary attack on it is occurring? WiFi gives the user an authentication failed message after entering an incorrect WiFi password several times....
27
votes
11answers
9k views

Best password strength checker

In XKCD #936: Short complex password, or long dictionary passphrase? Jeff claimed that password cracking with "dictionary words separated by spaces", or "a complete sentence with punctuation", or "...
-4
votes
1answer
513 views

How can WPscan bruteforce passwords without hitting any limit rate?

I've just watched this video which shows the attacker bruteforcing both usernames and passwords. How can this be achieved without hitting any limit rate? Does it mean that WordPress doesn't provide ...
2
votes
1answer
601 views

Tools and computer specs for password cracking [closed]

To polish my penetration testing skills I want to attempt to crack NTLM/NTLMv2 hashes (via dictionary/wordlist attack) extracted from Active Directory / SAM database, where the underlying passwords ...
2
votes
1answer
2k views

Maximum tries for 2FA code?

I am building a website and I am implementing two factor authentication (2FA). The second factor will be a random 6 digit code like those from Authy. This site will store very confidential information....
4
votes
3answers
509 views

Could using a generated key from an online service be considered a risk?

With some colleagues we're having a debate regarding the randomkeygen.com website. I do think that there is a security risk using the generated keys of this (or any of this kind) website. Why ? ...
-1
votes
2answers
393 views

Limiting five letter string to only include words from dictionary in Crunch?

I am creating a word list for attacking a personal .dmg file on OS X. I'm using John the Ripper for the cracking, and Crunch to create the word list: ./crunch 13 13 abcdefghijklmnopqrstuvwxyz ...
9
votes
3answers
484 views

How to calculate brute forcing times/feasibility for remote attacks to include parallelism?

This is purely a thought exercise. Assume a server which does not implement throttling or lock on failed attempts. The server accepts a username/password request & sends back a Yes/No response. ...
2
votes
1answer
1k views

How is it that tools like Hashcat, JTR able to bruteforce an NTLMv2 hashes?

With regards to the following question about the feasibility of (brute|dictionary|rainbowtable)-forcing an NTLMv2 hash: How feasible is it for an attacker to brute-force an NTLMv2 response captured ...
0
votes
1answer
173 views

Database logs have multiple “Logon Login failed for user” from different IPs

Background: I have an SQL Server database running on Amazon RDS The AWS dashboard has a section for logs and whenever I check the logs I see the following: 2018-04-27 06:10:26.00 Logon Error: 18456,...
8
votes
2answers
14k views

How long would it take to brute force an 11 character single-case alphanumeric password?

My previous home wifi router's WPA2 password was permanently fixed to FZ4HBCKHGC8. How long would it take to crack via brute force? Or more pragmatically: How long would it take to exhaust all ...
6
votes
3answers
3k views

How can i calculate the number of possible passwords?

I have found a flaw in a site where the password reset feature resets passwords in the following format UpperCaseLetter-Number-LowerCaseLetter-Number-LowerCaseLetter-Number-UpperCaseLetter Eg: ...
5
votes
2answers
570 views

Avoid being hacked with brute-force attack

During the last week, our company website has been under a weird brute-force, this attack actually led to hacking an admin account. Our website is a wordpress site. The attacker keeps performing POST ...
2
votes
2answers
910 views

Is it still possible to run an online dictionary attack from a single machine, without anonymisation?

This question concerns dictionary attacks conducted: Over the Internet, using programs like THC Hydra Via protocols such as HTTP, FTP and SMTP I believe I'm right in thinking that: a) due to the ...
8
votes
4answers
9k views

Calculate time taken to break AES key

A 256 bit AES key is required to be broken using the brute force method on a 2GHz computer. How long would it take to break the key in the best case and in the worst case situations? Assume that 1000 ...
5
votes
1answer
179 views

How would someone attack a not truly random secret produced by a human?

Especially in cryptocurrencies you often hear people say that private key/seeds should not be typed "randomly" by humans, but rather use a truly random number generator. I understand, that humans ...
0
votes
1answer
2k views

How can hackers get 1 billion passwords per second?

So I'm interested in Brute Force attacks and I have made them with Python 3 and C++. However, those only reached a max of about 20 million passwords per second. I know for a fact that 1 billion ...
5
votes
3answers
2k views

Perfectly Robust Hashing Scheme, or Completely Over-Engineered?

This is going to get long, so prepare. Basis of the question is, Do all these steps improve security, or am I completely overthinking the problem? Are my assumptions/thought process valid? We all ...
27
votes
3answers
5k views

Use multiple computers for faster brute force [duplicate]

I've watched Mr. Robot lately and can't stop thinking why it was so hard to decrypt files encrypted using AES encryption with a 256-bit key. Let us say the only method to find the key is through brute ...
0
votes
1answer
170 views

Should a CDN service like Cloudflare protect against Brute Force Attacks, or only from DDoS?

I know that CDN services usually protect a user by hiding it's original machine's IP and by screening (and banning) any attackers that send too many requests in the form of DDoS. But should a CDN ...
1
vote
0answers
164 views

Using hydra on a website that has the same response for both a wrong and correct password

I got my hands on an old-ish residential gateway with SIP support and two analog phone connections. I want to use it for it's SIP support to use analog phones with my SIP provider. I didn't know the ...
5
votes
2answers
2k views

How much faster does a GPU or FPGA crack an RSA key compared to a CPU?

Are there any significant speed up in time on cracking an RSA key (either brute-force or factoring with general number field sieve) using a GPA or FPGA compared to a CPU? If there is a speed advantage,...
8
votes
1answer
736 views

SSH Brute Force Dictionaries

Request for logs please. So, I had an interesting question posed to me around geographical trends in SSH brute force attempts. The question being "has anybody ever looked into the prevalent SSH ...
1
vote
1answer
182 views

Is signing safe from brute force attacks?

I am using itsdangerous to sign a string using a secret key. It says that the signing mechanism is HMAC and SHA1 and that it is an implementation of the Django signing module. Assuming I use one ...
3
votes
1answer
123 views

If a password is encrypted and then the encryption is stolen is it best practise to change plaintext passwords?

Backgound Reading this article on BBC News dated 29th March 2018, the company in question suffered a data breach and up to 150 million accounts usernames, email addresses and passwords were ...
4
votes
1answer
2k views

Reasonable (BruteForce) Attempts/Second Estimate?

I've read various articles on password strength and passwords vs pass phrases (including the one from XKCD and its thread here), but most of those articles seem to be focused on online passwords, and ...
2
votes
1answer
169 views

GUI exe BruteForce login test

Hi I have created a login page Below. I want to test the security of my exe I do not want to use a captcha or timeout on my exe. Are there any applications specifically designed for bruteforcing .exe ...
3
votes
1answer
1k views

How to find out Wi-Fi password with dictionary attack without connecting to the Wi-Fi?

I have some specific problem. Is there any possibility how to find out Wi-Fi password with dictionary attack without connecting to the Wi-Fi? I need it for my bachelor thesis, where I am using ...
6
votes
3answers
14k views

How can Facebook possibly stop a bruteforce attack on an account?

I've been doing some research on hacking recently and I found some very interesting tutorials on brute force cracking. I have some questions to ask and I'll be using Facebook as an example. Let's say ...
0
votes
1answer
235 views

Review on encrypted data storage algorithm

I'm building a small command line tool (mostly for fun) that is meant to store data (such as passwords or files) encrypted into a local database, with a user supplied password, pretty much the same ...
3
votes
1answer
5k views

Should user account be locked after X amount of failed logins?

I have almost finished developing my login system and there is one more thing that I'm not sure about. So many debates I found on the internet about counting invalid logins and locking users account. ...
5
votes
3answers
765 views

Is login limiting still needed if we employ multi-factor authentication?

The status quo is that most online websites limit login attempts per IP address, or even per account since some attackers possess huge amounts of IP addresses. Removing login limits would have the ...
4
votes
4answers
2k views

Brute force prevention: where and when?

I design a 'secure' login system. Let's focus in the brute force prevention. In my Android client I have a counter that counts the number of times that the user tries to login, with false credentials. ...
68
votes
8answers
22k views

Am I experiencing a brute force attack?

When checking the auth log of a server with the command: grep sshd.\*Failed /var/log/auth.log | less I see thousands of lines like this: Jan 12 11:27:10 ubuntu-leno1 sshd[8423]: Failed password ...
1
vote
0answers
349 views

THC Hydra false positives on Foscam login

I bought a Foscam C1 Lite this week and I want to try to brute force the login page with THC hydra. But currently I am getting false positives with the following command: hydra -s 88 -l user -P ...
2
votes
2answers
388 views

Prevent Brute force attacks on WordPress with SSHguard

I've installed sshguard: sudo apt-get sshguard -y and it works fine (I tried to "brute force" my own server and was blocked). I desire to utilize sshguard to defend form brute force attacks on ...
1
vote
1answer
158 views

Can SSL traffic encrypted with a weak cypher be bruteforced?

Take the following scenario: Attacker performs a man-in-the-middle attack on Client, redirecting the DNS records of www.example.com to point to a malicious server Client connects to the malicious ...
11
votes
1answer
65k views

Forgot password to 7-Zip archive

I think I already know the answer to this question, but I thought I'd ask the experts anyway. A few months back, I created a password-protected 7-Zip archive which housed the source code of a simple ...
1
vote
1answer
2k views

How to use character mask in hashcat?

I do not get hashcat working the way I want. I got this handshake captured file. I can crack it with ?a?a?a?a?a?a?a?a --increment but since I know the password is between 14 and 16 charters that is ...