Questions tagged [brute-force]

An attack using every possible input to attempt to produce the correct output. Typically the method of last resort when no weakness allows the use of a more restricted input set. E.g. trying all possible (or likely) passwords, in an attempt to guess the correct one.

Filter by
Sorted by
Tagged with
2
votes
3answers
1k views

How to stop brute force attack that is DDoSing our server?

We have a web application and that's been frequently hit with random username and password to find a successful login attempt. We introduced CAPTCHA, random token generation but that didn't stop the ...
1
vote
2answers
60 views

In what cases should applications be prepared for brute force?

Today I had an idea: I've been thinking that one can use brute force to get some data from a university from our country. It turned out my thoughts were true: an attacker can use brute force to ...
2
votes
0answers
2k views

Intercepting hydra with burp suite

I'm using burp suite as a proxy and when I run hydra, burp suite should be able to catch that and log it in HTTP history, but instead of that I get the error Can not connect [unreachable] I tried ...
2
votes
2answers
613 views

Do I need a “cryptographically secure” random value for an unguessable URL?

tl;dr: Is a pseudorandomly generated string unguessable enough to be used as token in a URL? I'm making a web application, let's for the sake of argument assume it's another PasteBin. I allow users ...
33
votes
5answers
8k views

SSH - If Eve has the passphrase and public key, can she derive the private key?

I have used ssh-keygen for creating an RSA 4096-bit SSH private and public key pair. I used a passphrase for the private key. If an attacker, Eve, knows the passphrase in addition to the public key: ...
1
vote
1answer
361 views

Brute force email in JSON format

I have a parameter args=[490114,{"user_login":"user@example.com","":"","perm":"view","partners":[],"event_labels":[]}] in the HTTP request but in the encoded format. I want to brute force this ...
7
votes
3answers
5k views

Which is faster - brute-forcing, or using a dictionary attack that contains all possible permutations?

Assuming a 6-character password uses the mixalphanumeric charset, giving each character a character set of 62 and the entire password a keyspace of 62^6 = 46.6 billion (if my calculations are correct)....
4
votes
2answers
526 views

What's the correct term form a pre-computed table with password/hash pairs?

The table looks like this: 123456 -> asfty18u78t489yh password -> 89y203rupdifhof something -> 2r892389n89rfsd And the idea is that if you have the hash (asfty18u78t489yh), you know ...
0
votes
1answer
134 views

Distinguishing Between Brute force and Crawlers in error reporting

I have been receiving a great many emails recently reporting issues within my website that, when gone back and looked up, have been reported as being Brute force attacks. Upon further inspection of ...
3
votes
1answer
448 views

Is logging into SSH with a 2048 bit SSH password less secure than logging in with a a 2048 bit private key? [duplicate]

I'm certainly not saying this is a "good idea," and I always disable password authentication on SSH servers. However, the question came up when talking to a friend: If your password is as long and ...
1
vote
2answers
3k views

Brute force HMAC SHA256 (HS256) equals to break JSON web token signature?

The format of JSON Web Token is: encoded (header). encoded(payload). signature with a secret (for example, use sha256 to sign). In case of hmac sha256 (HS256)-selected JWT, if the secret is not long ...
2
votes
2answers
104 views

Are complex passwords necessary in web applications? [duplicate]

If there is a web application that holds important data, how important is it to use a complex/long/secure passphrase? When I use for example something like "applefreezer" as password for my admin ...
1
vote
1answer
3k views

Alternatives to bruteforce KeePass Cracker

Recently I have been working on a little project. I have been able to crack my keePass .kdbx file by running a simple brute force attack with the KeePass Cracker and a custom made word list. This is ...
0
votes
2answers
699 views

Why not crack a password a character at a time?

Brute force can be used to crack passwords by trying a large number of passwords. Why does no one try the brute force approach on every single character of the password instead?
1
vote
1answer
139 views

What ways are there to populate web directory wordlists?

Background: as a pentester I often just get IP addresses where websites are hosted. Since sometimes DNS is not available or the client wants a black box test, getting to the actual hosted application ...
1
vote
0answers
832 views

Hydra http-post-form dosen't work even if i got right parameter

I use BurpSuite to capture post request like this. After that I use hydra with syntax like this hydra -l admin -P pass.txt 192.168.0.1 http-post-form "/login.asp:Username=^USER^&checkEn=0&...
3
votes
2answers
273 views

Naive key stretching vs PBKDF2

What are the drawbacks of using a trivially simple key stretching approach such as the below Python example, compared to something like PBKDF2? The purpose is to harden an AES-encrypted file against ...
0
votes
1answer
6k views

How did hackers brute force my Windows server username?

About a year ago my Windows server 2008 R2 server was hacked. I had RDP open to the world, I know, not a good idea. Being that it was a year ago I don't have any of the logs, but I was thinking about ...
1
vote
1answer
1k views

What is the recommended length for a phone PIN?

I recently read that you're supposed to have a phone pin consisting of at least six digits. Why? I'd get it if the pin was stored as a hash in a database, even though six digits would easily be ...
3
votes
2answers
624 views

Brute force algorithm to break symmetric key. How to find the program when current key is the correct one?

In a brute force program, sequential keys are tested against the public key in order to find the correspondent private key. My question is, how is the test done with each key that let you conclude ...
1
vote
3answers
788 views

Creating a wordlist knowing parameters

I need to crack my own router password. Advantage is that I know possible characters and maximum length. What I need is to create a dictionary. The dictionary should contain all the combos of ...
0
votes
1answer
311 views

Setting payload for email using burp intruder [closed]

I am setting up the burp intruder attack for email. For example, youremail@gmail.com Now when i added $ it takes youremail@gmail%2ecom so i am getting the result as email is invalid type. My aim is ...
3
votes
1answer
407 views

Which algorithm for login throttling

I'm about to add a throttle to a login page to stop it being brute forced easily. I was going to use the leaky bucket algorithm to implement the throttle on a per user/IP basis. Is this considered OK ...
0
votes
1answer
1k views

Brute force web page using Hydra [closed]

What is the problem in this command for hydra, it returns these errors: Command : hydra -l 950421521 -P /home/jarvis/Desktop/ams-2.lst 172.20.10.4 http-post-form "/login.aspx:&txtUserName=^USER^&...
41
votes
3answers
8k views

Should Failed Login Attempts Be Logged

Should failed login attempts be logged? My doubt is that if there is a distributed brute force attack, it might exhaust the available disk space of the database. What is the best practice for this? I'...
26
votes
8answers
6k views

How to respond to a SSH brute force attack on a single VPS?

I logged onto my VPS this morning to find millions of failed login attempts for the root user and other users that don't even exist. I took the below measures to try and obfuscate the attackers ...
1
vote
0answers
49 views

Is it possible to crack WPA2 faster than brute-force? If yes, how? [duplicate]

Does WPA2 have any weaknesses, flaws or gaps that would make a hack faster than brute-force possible? Maybe I can hijack authorized user's session or trick AP itp.
1
vote
0answers
180 views

Generating Rainbow Tables with Salt/Prefix [closed]

I would need a tool that would allow me to create rainbow table for custom password pattern. The pattern is 9-XXXXXXXXX where X is alphanumberic character and 9- is fixed prefix, as well as fixed ...
2
votes
1answer
724 views

Bruteforce App login forms on Android

I was wondering if there is any way (app or something) to bruteforce app login forms on Android?
0
votes
2answers
1k views

How customising a wordlist to make a bruteforce attack in leetspeak with hashcat or John the ripper

I'm trying to unlocking my encrypted external harddisk because I have lost my paper with the password. With the help of user3439894 I have a short program to injecting a wordlist and unlocking the ...
1
vote
1answer
3k views

OWASP ZAP bruteforce by password not username

I want to bruteforce a login page using OWASP ZAP, using two separate passwords (90 lines) and username (200 lines) files, with the bruteforce POST requests to be ordered by password like: user001:...
0
votes
1answer
2k views

How can one prevent HTTP-authentication Brute Force Attacks, on PHPmyadmin with CSF-LFD?

I use PHPmyadmin (PMA) to manage my SQL based DB on an Apache environment secured with CSF-LFD (that as I know, also called "Fail2ban"). I don't want to protect PMA by limiting it to a certain IP or ...
1
vote
0answers
262 views

Password Strength: Compound Words [duplicate]

I’m familiar with XKCD’s Correct Horse Battery Stable example but I am wondering about one aspect of password strength. Dictionary words are an easy target for password crackers. If you compound a ...
3
votes
1answer
659 views

Is TCP Sequence Bruteforcing dangerous nowadays?

I was reading about TCP sequence prediction which is described as almost impossible on all updated Operating System nowadays. The total amount of possible sequence numbers is 2^32-1 which, if we try ...
2
votes
2answers
6k views

How to recover a lost zip file password (Extract Zip Spec '2.0')

I want to recover my backup file, but I can't find the password. The password contains 12-20 characters (As!@$123) user@PC:/media/user/MyData$ zipdetails -v backup2.zip 0000000 0000004 50 4B 03 04 ...
4
votes
5answers
1k views

What makes one random strong password more resistant to a brute force search than another

The only way to do this is by making an educated guess on how the brute force algorithm works or probably works. Lets say you were trying to crack a combination lock with 3 discs each with 10 ...
58
votes
6answers
12k views

Wrong password - number of retries - what's a good number to allow?

Most sites & software seem to have a default of auto lock or time lock after 3 wrong tries. I feel that the number could be much higher - not allowing retries is mainly to prevent automated ...
15
votes
3answers
3k views

Are HTTP brute-force password-guessing attacks common nowadays?

Are brute-force attacks against online accounts (gmail, facebook, instagram) something that really happens? I don't mean something like cracking password hashes or DDoS, but real brute-force attacks (...
-1
votes
2answers
393 views

Limiting five letter string to only include words from dictionary in Crunch?

I am creating a word list for attacking a personal .dmg file on OS X. I'm using John the Ripper for the cracking, and Crunch to create the word list: ./crunch 13 13 abcdefghijklmnopqrstuvwxyz ...
2
votes
4answers
784 views

How to figure about the total amount of password combinations possibles that have salt values?

I'm reading this book about Computer Security to better prepare me for my role, however, this question is just not clicking to me. I've figured out half of it, but cannot figure out this last part. If ...
-1
votes
2answers
3k views

How do I brute-force a WPA-2 wifi with Aircrack-ng in Kali Linux?

What I basically want to do is, perform a test on my Wi-Fi and brute force it instead of a dictionary attack. I googled, and all of them showed me examples of dictionary attack and no bruteforcing. ...
0
votes
1answer
2k views

How do I change my IP Address after a specific number of loops in Python? [closed]

I have a for loop to brute force a Gmail account. But I've heard that Gmail's max attempts is 100. So how do I change my IP after 100 loops? Thanks in advance.
3
votes
1answer
334 views

Do any routers report a brute force attempt?

In our work office, we have a router but the password for it has been lost. We don't want to do a factory reset except as a last resort. I could try brute forcing the login, but I'm afraid that some ...
7
votes
1answer
5k views

Bruteforce part of password in TrueCrypt

I own a TrueCrypt container and I can't open it. I remember part of its password. So I want to bruteforce attack on it. I tried many parameters in oclHashCat but none worked (parameter problem). Can ...
-1
votes
2answers
3k views

Calculating permutations of a hexadecimal character set [closed]

How long would it take to run through all permutations/combinations of a ten character set; assuming the character-set is limited to a hexadecimal alphabet? (i.e. 16 characters {0..9}{A..F}; eg. ...
26
votes
4answers
9k views

How practical is it to bruteforce a 10-digit number via URL

Example URL www.[somewebsite].com/[10_digit_number] Getting the correct number loads a page. I know there would be 10 billion possible digits to choose from, but how long would it take? What are the ...
2
votes
3answers
815 views

How secure are pins on credit / bank cards?

Everyone owns a card from the bank. Every card has 4 digit pin. If someone steals / finds my card I know that this 10.000 combinations are silly stuff to crack. I presume with some piece of hardware (...
4
votes
1answer
104 views

Is decryption of past conversations a legitimate concern?

Suppose sensitive information is sent over an insecure channel, but it is encrypted with a cipher such as AES. As of this writing AES is not broken and brute-forcing it would take more than millions ...
7
votes
2answers
8k views

Cracking a JWT signature

I am testing an API that uses JWT for authentication. This JWT has a HS256 signature to prevent modification. I figured that if I determine the secret key used in this signature, I can create my own ...
3
votes
2answers
483 views

Does using characters specific to language make password stronger

So let's start of example. I live in England, and have a Polish keyboard. I can use Polish specific letters like ąćęłńóśżź, one could also use German ßäë etc. Would using those letters make password ...