Questions tagged [brute-force]

An attack using every possible input to attempt to produce the correct output. Typically the method of last resort when no weakness allows the use of a more restricted input set. E.g. trying all possible (or likely) passwords, in an attempt to guess the correct one.

Filter by
Sorted by
Tagged with
8
votes
2answers
21k views

How long would it take to brute force an 11 character single-case alphanumeric password?

My previous home wifi router's WPA2 password was permanently fixed to FZ4HBCKHGC8. How long would it take to crack via brute force? Or more pragmatically: How long would it take to exhaust all ...
5
votes
2answers
604 views

Avoid being hacked with brute-force attack

During the last week, our company website has been under a weird brute-force, this attack actually led to hacking an admin account. Our website is a wordpress site. The attacker keeps performing POST ...
0
votes
2answers
6k views

Hydra fails with “[ERROR] target ssh://192.168.16.128:22/ does not support password authentication.”?

I've updated Kali 2.0 to newest version - it is installed using VMWare. Now, every time I use hydra to brute-force SSH, I get the following error: [ERROR] target ssh://192.168.16.128:22/ does not ...
0
votes
1answer
2k views

How can hackers get 1 billion passwords per second?

So I'm interested in Brute Force attacks and I have made them with Python 3 and C++. However, those only reached a max of about 20 million passwords per second. I know for a fact that 1 billion ...
1
vote
0answers
190 views

Using hydra on a website that has the same response for both a wrong and correct password

I got my hands on an old-ish residential gateway with SIP support and two analog phone connections. I want to use it for it's SIP support to use analog phones with my SIP provider. I didn't know the ...
0
votes
1answer
194 views

Should a CDN service like Cloudflare protect against Brute Force Attacks, or only from DDoS?

I know that CDN services usually protect a user by hiding it's original machine's IP and by screening (and banning) any attackers that send too many requests in the form of DDoS. But should a CDN ...
3
votes
1answer
124 views

If a password is encrypted and then the encryption is stolen is it best practise to change plaintext passwords?

Backgound Reading this article on BBC News dated 29th March 2018, the company in question suffered a data breach and up to 150 million accounts usernames, email addresses and passwords were ...
2
votes
1answer
239 views

GUI exe BruteForce login test

Hi I have created a login page Below. I want to test the security of my exe I do not want to use a captcha or timeout on my exe. Are there any applications specifically designed for bruteforcing .exe ...
3
votes
1answer
2k views

How to find out Wi-Fi password with dictionary attack without connecting to the Wi-Fi?

I have some specific problem. Is there any possibility how to find out Wi-Fi password with dictionary attack without connecting to the Wi-Fi? I need it for my bachelor thesis, where I am using ...
3
votes
1answer
6k views

Should user account be locked after X amount of failed logins?

I have almost finished developing my login system and there is one more thing that I'm not sure about. So many debates I found on the internet about counting invalid logins and locking users account. ...
1
vote
0answers
417 views

THC Hydra false positives on Foscam login

I bought a Foscam C1 Lite this week and I want to try to brute force the login page with THC hydra. But currently I am getting false positives with the following command: hydra -s 88 -l user -P ...
30
votes
1answer
11k views

How does the attacker know what algorithm and salt to use in a dictionary attack?

I am curious about password cracking methods like dictionary and brute force attacks. Nowadays passwords are stored as hashes and not plaintext on the server. Then how can the plaintext passwords in ...
26
votes
3answers
11k views

Is this what a brute force SSH attack looks like?

I reviewed the auth.log file on my Ubuntu server to find: [preauth] Feb 22 17:39:18 code-storage sshd[17271]: Disconnected from 147.135.192.203 port 49408 [preauth] Feb 22 17:40:15 code-storage sshd[...
0
votes
1answer
1k views

Brute Force Decrypt VeraCrypt - No Rescue Disk - Password Fails

My PC has failed in some way, as the PC was off when I checked it. I checked the CPU temperature etc., and runs at 54deg C in the BIOS, and does not fail when left on. So, I am not sure if it is a ...
0
votes
1answer
509 views

Are ciphers with a strength of 112 bits considered weak?

SSL/TLS Ciphers of strength 128 bit is considered strong while ciphers of strength 112 bits is considered weak. Ciphers of 56 bit is understandably weak as they can be easily brute-forced. If it is ...
0
votes
2answers
326 views

How to bruteforce smime.p7m key

My information security teacher gave me homework - hack smime.p7m. He said that the key is simple and bruteforce will not take much time, but I can not find a utility to do this. Maybe you know these?
-1
votes
1answer
560 views

How to brute-force a login that uses passwords of a specific format? [closed]

For example, if a website login that uses password of a specific format containing 3 letters and 3 numbers like abc123, qwr345, yta921... What tools on Kali Linux can crack this type of password and ...
0
votes
1answer
239 views

Review on encrypted data storage algorithm

I'm building a small command line tool (mostly for fun) that is meant to store data (such as passwords or files) encrypted into a local database, with a user supplied password, pretty much the same ...
4
votes
2answers
2k views

How to safely create a “honeypot (linux) user”

Would following be a feasible security feature to detect attempts? Creating a user with following specs: Username admin Password fairly insecure (not 123456, but a dictonary word) Special ...
1
vote
0answers
793 views

Kerberos and brute-force attacks

Suppose that I am the administrator of a system that uses Kerberos and password authentication. How can I make brute-force attacks on user’s passwords by an attacker who can capture network traffic ...
0
votes
1answer
185 views

if salt stored in user, will it be possible to use brute force attack? [duplicate]

I had done a lot of research about this topic. Before Researchs I found that some people suggest that to hide salt is not important: https://crackstation.net/hashing-security.htm But also this ...
2
votes
2answers
314 views

How attackers extract data from cipher text using brute force?

Lets take an example. Plain text: HJOU UT Cipher text: IKPV VU Above one just a simple substitution technique. Data is random text. If attackers substitute -1 then they will get GINT TS. Otherwise if ...
2
votes
2answers
438 views

Prevent Brute force attacks on WordPress with SSHguard

I've installed sshguard: sudo apt-get sshguard -y and it works fine (I tried to "brute force" my own server and was blocked). I desire to utilize sshguard to defend form brute force attacks on ...
3
votes
2answers
606 views

SSHguard: Does one to change any configuration for basic usage of the program?

I use Ubuntu 16.04 and I've installed SSHGuard (sudo apt-get install sshguard -y) to protect from Brute Force Attacks (BFAs) on whatever user. From reading about the program in ArchLinux wikipedia ...
0
votes
1answer
597 views

Are passwords longer than 128 bits useless if hashed with MD5? [duplicate]

Are passwords that are longer than 128 bits useless if they get hashed/transmitted with MD5? MD5 always uses 128 bits, thus someone would rather try to bruteforce the MD5-hash than the password ...
9
votes
2answers
8k views

Passphrase vs. password entropy

For a while now I have been interested in the passphrase concept as a potentially more secure replacement for classical passwords. My interest stemmed from a gut feeling that passphrases would be of a ...
-4
votes
1answer
2k views

Hydra brute-force not working [closed]

This is the command I am using and when I press Enter : hydra -L username.txt -P passwords.txt localhost http-post-form "dvwa/login.php:username=^USER^&password=^PASS^&Login="Login Failed" > ...
0
votes
2answers
1k views

Is it security if an alternative of the full credit card number is stored in database

Short Description I am wondering if there is a way to store an alternative of the full credit card number securely, which the card number is not required to be retrieved from the alternative. Long ...
5
votes
1answer
182 views

How would someone attack a not truly random secret produced by a human?

Especially in cryptocurrencies you often hear people say that private key/seeds should not be typed "randomly" by humans, but rather use a truly random number generator. I understand, that humans ...
0
votes
3answers
361 views

Can ModSecurity defend from Brute Force Attacks on PHPmyadmin and WordPress as well?

Can the software ModSecurity defend from Brute Force Attacks on PHPmyadmin and WordPress as well? A particular hosting company providing shared hosting told me that ModSecurity should cover ...
4
votes
1answer
653 views

Wireshark HTTP continuations (Hydra HTTP version)

I am trying to use Hydra to brute force a HTTP POST form page, however the page is returning a HTTP Continuation I'm not sure what that is. This is being caused by the HTTP/1.0 at the top of the ...
2
votes
2answers
1k views

Is it still possible to run an online dictionary attack from a single machine, without anonymisation?

This question concerns dictionary attacks conducted: Over the Internet, using programs like THC Hydra Via protocols such as HTTP, FTP and SMTP I believe I'm right in thinking that: a) due to the ...
4
votes
1answer
522 views

How to brute force a Java Applet in browser?

I am solving a CTF challenge and it is multi-layered: https://net-force.nl/challenge/level314/ (Modern browsers don't support Java Applets anymore and I had to download Opera browser 9.x to run the ...
-4
votes
1answer
106 views

Using 128-bits as an input for hashing using SHAKE-3 (128-output)

I would like to know the time estimate for a brute force attack to break my input (128-bit) which means 2^128 possibilities are there. Any online tool for that or any article which talks about that?
0
votes
1answer
413 views

RDP Audit Failures Brute Force Attacks

I need some help on tracking the source of these RDP access attempts on our terminal server. Port 3389 is open on the firewall (I know this is a terrible practice. I don't want to hear advice on ...
0
votes
1answer
2k views

Efficient Way to Brute Force With Large Wordlist

I am considering attempting to perform an SSH brute force attack on my own device in order to test its security, but I have run into an issue with the wordlist. I know my own password format, as well ...
1
vote
1answer
3k views

How to use character mask in hashcat?

I do not get hashcat working the way I want. I got this handshake captured file. I can crack it with ?a?a?a?a?a?a?a?a --increment but since I know the password is between 14 and 16 charters that is ...
3
votes
0answers
680 views

Hydra does not display the right answer in DVWA

I have been trying for days now to use Hydra in an attempt to crack DVWA brute force but to no avail, I am using the correct session cookie and to my knowledge have the correct syntax? Query is: ...
3
votes
0answers
135 views

Why I have more than one valid passwords with Hydra? [duplicate]

I am trying to do a brute force with Hydra on a web page but it isn't DVWA so I don't have control over code. The failed result has 200 OK response and "Area protegida" message. I tried it with this ...
0
votes
1answer
94 views

Experiencing injection / brute force attacks

I'm handling a hosting services for website via WHM. Few months ago, I've been experiencing some automated attacks on the websites that I'm handling. See screenshots below: Are there any remedy for ...
98
votes
5answers
30k views

Someone is trying to brute-force(?) my private mail server… very… slowly… and with changing IPs

This has been going on for about 1-2 days now: heinzi@guybrush:~$ less /var/log/mail.log | grep '^Nov 27 .* postfix/submission.* warning' [...] Nov 27 03:36:16 guybrush postfix/submission/smtpd[7523]:...
4
votes
4answers
2k views

Brute force prevention: where and when?

I design a 'secure' login system. Let's focus in the brute force prevention. In my Android client I have a counter that counts the number of times that the user tries to login, with false credentials. ...
0
votes
1answer
262 views

What are the best algorithms against known plaintext attack?

I'd like to encrypt files and their metadata as well. They will be stored in some sort of database (not yet decided, probably pgsql). The metadata can be for example the creation time, the ...
0
votes
1answer
3k views

John the Ripper Character Lists

How is it possible to use or prioritize umlauted characters - ä ö ü ß Ä Ö Ü - whilst brute forcing. I'm not using any wordlist, only dozens of CPU threads via the following command : ./john --fork=...
4
votes
2answers
434 views

Quantum Computer Advantage in SSH Login

I understand that quantum computers are many orders of magnitude faster than today's binary computer and that this is expected to enable decryption that was unlikely (it would take too long) with ...
2
votes
3answers
711 views

How secure is a password made up of three or four three-letter words?

According to this, a password such as dinwryran is secure against a brute-force attack. Is this true? If not, why?
7
votes
1answer
1k views

How to interpret this statement against 4096-bit RSA

While I'd agree that double-sized RSA keys may pose more problems than the gain in security possibly justifies, I am having problems understanding the argument made here: https://gnupg.org/faq/gnupg-...
2
votes
1answer
453 views

Are there bruteforce programs that use letters of other languages? Arabic? Greek?

I came across a site that had the password strength meter. I tried using 'password' and the meter did not like my password. Then I happened to try 'password' but I used the arabic translation for 'a' ...
-1
votes
1answer
700 views

How do I find out how long a password is for a 7zip aes 256 encryption? [closed]

I lost password to a 7zip, nothing important in it. But i'll still like to access it. I heard there is a way to find out how long the password is, but I dont know how.
1
vote
1answer
233 views

Can SSL traffic encrypted with a weak cypher be bruteforced?

Take the following scenario: Attacker performs a man-in-the-middle attack on Client, redirecting the DNS records of www.example.com to point to a malicious server Client connects to the malicious ...

1 2 3
4
5
14