Questions tagged [brute-force]

An attack using every possible input to attempt to produce the correct output. Typically the method of last resort when no weakness allows the use of a more restricted input set. E.g. trying all possible (or likely) passwords, in an attempt to guess the correct one.

Filter by
Sorted by
Tagged with
0
votes
1answer
774 views

Is HTTP POST insecure?

Is it possible to perform a MITM attack or even bruteforce a HTTP POST? If so how does one perform an attack and how can a developer protect his/her site from such an attack?
0
votes
1answer
3k views

How can one prevent HTTP-authentication Brute Force Attacks, on PHPmyadmin with CSF-LFD?

I use PHPmyadmin (PMA) to manage my SQL based DB on an Apache environment secured with CSF-LFD (that as I know, also called "Fail2ban"). I don't want to protect PMA by limiting it to a certain IP or ...
0
votes
2answers
216 views

Why is it a problem to store strong passwords as unsalted hashes?

My users all have strong (80-bit true entropy) passwords. How do I know that? Because my imaginary website randomly generates the passwords for them (client-side). In that context, could you explain ...
0
votes
2answers
2k views

Bruteforce Passphrase of Dictionary Words

Consider the all lowercase passphrase: "lazy fox haggles treaty" Assume all four words are in a dictionary of 2000. Bruteforcing word combinations, how long does it take to crack this password at ...
0
votes
1answer
2k views

How can hackers get 1 billion passwords per second?

So I'm interested in Brute Force attacks and I have made them with Python 3 and C++. However, those only reached a max of about 20 million passwords per second. I know for a fact that 1 billion ...
0
votes
1answer
173 views

Should a CDN service like Cloudflare protect against Brute Force Attacks, or only from DDoS?

I know that CDN services usually protect a user by hiding it's original machine's IP and by screening (and banning) any attackers that send too many requests in the form of DDoS. But should a CDN ...
0
votes
1answer
450 views

Are ciphers with a strength of 112 bits considered weak?

SSL/TLS Ciphers of strength 128 bit is considered strong while ciphers of strength 112 bits is considered weak. Ciphers of 56 bit is understandably weak as they can be easily brute-forced. If it is ...
0
votes
1answer
1k views

Defence for brute force attacks to ssh

At some point in the past I had a small (physical) webserver. From day 1 there were brute force attacks to ssh. I looked it up a bit and I set up iptables to block IPs that try to connect to ssh more ...
0
votes
3answers
802 views

Can X.509 Authentication be subject to brute force attacks?

I am working on an application (using Spring Security) that has two possible user authentication mechanisms: either X.509 certificate (using mutual SSL handshake) or user + password For user+...
0
votes
3answers
970 views

Crack Linux password if you have plaintext and hash?

I have a relatively old Linux system, where password are not shadowed, therefore stored in /etc/passwd/. My question is, since I know the cleartext password, and its hash (looking at the passwd file),...
0
votes
2answers
128 views

Library or service for rate limiting credit card transactions by IP [closed]

I have a simple product ordering form. A hacker is attempting to validate stolen credit card numbers by making two orders per minute with a bot. 99% of the orders are declined but some are completed....
0
votes
1answer
554 views

Can a botnet be used to effectively break encryption keys?

Can a botnet amass and coordinate enough computing power to break encryption keys that are typically considered to be secure (through brute force)? If this is the case, do we need to make our ...
0
votes
1answer
14k views

Hydra bruteforce is giving wrong passwords. Can't seem to work any help? [closed]

Ok so what im actually trying to do is to bruteforce my own account on some website just to check myself . This is NOT for illegal steps or use , im trying to crack my OWN password , and im trying to ...
0
votes
3answers
167 views

Is an 8 characters long password reset token strong enough?

I am testing a website with a password reset functionality that provides a link with a token like most websites. I asked for multiple password reset links to see any pattern in the tokens. All the ...
0
votes
1answer
323 views

Using hashcat for collision attack [closed]

Whenever i tried generate √N randomly(possible combinations of password length), i always find few collisons of the hash password no matter the length, if the password was made of entirely random ...
0
votes
1answer
749 views

Brute force MD5 with a prefix and suffix up to n characters/words

I have a couple of things I would like to explore with hashcat. I have a MD5 hashed password, which I know for a fact has a prefix and a suffix. The actual password is located in the middle of the ...
0
votes
1answer
227 views

What are the best algorithms against known plaintext attack?

I'd like to encrypt files and their metadata as well. They will be stored in some sort of database (not yet decided, probably pgsql). The metadata can be for example the creation time, the ...
0
votes
1answer
2k views

John the Ripper Character Lists

How is it possible to use or prioritize umlauted characters - ä ö ü ß Ä Ö Ü - whilst brute forcing. I'm not using any wordlist, only dozens of CPU threads via the following command : ./john --fork=...
0
votes
1answer
963 views

Brute force a hard drive when most of the password is known

I need to access a hard drive that is encrypted with LUKS. The password provided is incorrect, however it is only incorrect by a character or so. The password itself is very strong and above 30 ...
0
votes
1answer
1k views

Can someone bruteforce my OSX? (Macbook)

Is it possible for someone to bruteforce or perform a dictionary attack on a Macbook? It's very easy to bypass security of a Windows box (Password Protection) , what is the difficulty level of ...
0
votes
1answer
827 views

Brute force attacks detection risks

I would like to ask if using brute force attacks on some websites or online services can be risky in any way for the hacker? Let's say that someone is using medusa tool to crack password on his ...
0
votes
2answers
7k views

Bruteforcing blowfish

I am quite new to encryption and recently played around with blowfish (openssl's implemenation). I am using a 23 character password (case-sensitive alphanumeric random). I estimate the entropy to be ...
0
votes
4answers
774 views

Confidentiality of file hashes

Context: I have a directory full of sensitive company files. I want to compare these files with a colleague at a remote location, without the need for a secure connection. Is it safe for me to ...
0
votes
2answers
241 views

How do you overcome the problem of the salt being public and known by the attacker? [duplicate]

I believe that when adding a salt to the password you need to store the values so you can compute the hash again. But, what does happen if the attacker get the salt? How is it possible to add value ...
0
votes
1answer
104 views

Is encryption less resistant to brute-forcing compared to hashing?

I understand that a hashing algorithm like bcrypt uses several rounds of hashing to make it computationally expensive for a brute-force attack. How does encryption work against a brute-force attack? I ...
0
votes
1answer
135 views

Question about birthday attack on password

Based on birthday attack, you need to generate at least 2^n/2 of possible combination to have 50% chance of finding a password. I have a list of 3000 random password make from 16 characters of upper, ...
0
votes
1answer
104 views

Please may I know why I am getting this Sshd log

why I am getting this sshd log Feb 1 13:07:57 sshd[6453]: Failed password for root from 193.34.22.63 port 28980 ssh2 Feb 1 13:08:26 sshd[6897]: Failed password for root from 91.205.189.15 port 48155 ...
0
votes
1answer
248 views

I think my raspberry was hacked, what should I do? [duplicate]

First of all, sorry if all of this seems a bit stupid, but my field of expertise is software development, not security. So, here is what happened. 1/ The breach I did something I really shouldn't ...
0
votes
1answer
115 views

How is my employer accessing my router when employer's laptop is wirelessly connected to my home network

I have a modem bridged to a modern router running open source software and heavily secured. I have all connections to the router through a personal vpn from a dedicated provider. During work from home ...
0
votes
2answers
325 views

Protect MySQL against brute-force attacks on dedicated CentOS 7 server

I have a database in a dedicated server (CentOS 7) setup by an external provider. I see a disgusting amount of brute-force attempts in MySQL log file every day. I know the best option would be to not ...
0
votes
1answer
144 views

Are there any good brute force programs in C#? [closed]

I'm planning to research & learn from brute force methods, but all the popular ones I found like John the Ripper or hashcat are written in C & OpenGL which I don't have much knowledge about so ...
0
votes
2answers
78 views

Cryptography as an ecosystem

I was thinking about a thought experiment. Let's imagine a world full of crackers such that whenever you encrypt something there will be someone who will try to crack your cryptographic key through ...
0
votes
1answer
555 views

Is this possible to brute force 25 billions billions password in less than a month?

i'm using Hashcat for a while & try to solve this challenge: is this possible to crack at least half the possibilities combinations password of 10 character using 94 characters from keyboard with ...
0
votes
1answer
936 views

Which hashcat hash mode is closest to that used by BitLocker?

I'm trying to get a hypothetical benchmark for the BitLocker hash mode if Hashcat would support it. Which (-m) mode is closest to BitLocker's latest/default algorithm? From Google searches I learned ...
0
votes
1answer
895 views

Avoid brute force attacks on oAuth authorization server

I've been looking into the oAuth 2 authorization framework for a while now. Yesterday I started wondering how to prevent a brute force attack during the Authorization Code Grant flow (https://tools....
0
votes
1answer
980 views

Brute Force Decrypt VeraCrypt - No Rescue Disk - Password Fails

My PC has failed in some way, as the PC was off when I checked it. I checked the CPU temperature etc., and runs at 54deg C in the BIOS, and does not fail when left on. So, I am not sure if it is a ...
0
votes
1answer
429 views

WordPress 4.7.2 Authentication Cookie Brute-force

I recently came across a WordPress (v 4.7.2) site with an exposed wp-config.php file, within which plain text server authorisation key secrets were accessible. Having read Mike Czumak's article on ...
0
votes
1answer
188 views

Decrypt data with known text

So I have an encrypted text file that I know contains the phrase "potatoes are awesome" Is there a way for me to decrypt the text based on me knowing that phrase and the encrypted data? (I also don't ...
0
votes
1answer
147 views

Distinguishing Between Brute force and Crawlers in error reporting

I have been receiving a great many emails recently reporting issues within my website that, when gone back and looked up, have been reported as being Brute force attacks. Upon further inspection of ...
0
votes
1answer
7k views

How did hackers brute force my Windows server username?

About a year ago my Windows server 2008 R2 server was hacked. I had RDP open to the world, I know, not a good idea. Being that it was a year ago I don't have any of the logs, but I was thinking about ...
0
votes
1answer
100 views

Does stretching a hash increase a denial-of-service (DoS) risk and does brute-force protection mitigates that?

Disclaimer: I noticed several questions on this site but none really answer this two questions directly. Therefor I do not consider this duplicate. Personally I really like the article called Some ...
0
votes
1answer
556 views

Can a brute force attack be certainly prevented on a unix/linux shell?

I've been getting kind of curious about computer security. I know brute force has been discussed a fair bit on Stack, but I want to elaborate a bit by asking, "Is it possible to /certainly/ stop ...
0
votes
1answer
100 views

Can an old fashioned crypt encrypted file be brute forced, if so how?

If I encrypt a file using the old Unix/Linux crypt() function, how can it be decrypted or attacked? I understand how a password file (for example) is attacked, you guess passwords, run them through ...
0
votes
1answer
327 views

Ignoring collision and (second) pre-image resistance, what makes a cryptographic hash function strong?

With regards to resistance against dictionary and brute-force attacks to "crack" hashes containing passwords, what determines the resistance of a cryptographic hash function? Since collision ...
0
votes
1answer
145 views

Why doesn't SSH use a better algorithm for encrypting keys?

According to the answers in this question, SSH still uses a very basic algorithm for encrypting keys with a passphrase, which can be attacked at a rate of billions tries per second using dedicated ...
0
votes
1answer
3k views

THC Hydra 16 Valid Passwords? [duplicate]

So when I do hydra -l Admin -P "rockyou.txt" -s 80 192.168.13.1 http-get / it doesn't work for me. It says all 16 passwords are valid, but none of them works. Can anyone help me with this? I tried ...
0
votes
1answer
371 views

What is the best way to generate a password/pin like string using brute force method? [closed]

I have a string of 7 characters. I'm supposed to generate all the combinations. But some combinations are more likely than others, I would like the more likely ones to be generated first. If I ...
0
votes
1answer
27 views

How to prevent Directory Enumeration Attacks (DirB or Directory Buster)

I am dabbling in pen testing (OWASP Juice Shop) and I realized many web application attacks start from enumeration where the attacker uses DirB to find vulnerable Web Objects or Directories to attack ...
0
votes
1answer
37 views

UFW Blocks some IPs which are trying to attempt a connection to the server

UFW‌ Blocks some IPs which are trying to attempt a connection to the server. I checked most blocked IPs in abuseIPD website and all blocked IPs are reported for brute force attack and/Or ssh spamming ...
0
votes
2answers
52 views

Is it safe to implement 15 bytes password reset tokens?

I want to figure out how safe is to implement a 15 bytes long password reset token. If we have 26 letters and 10 numbers, 36 possibilities per byte. And we have a 15 byte long token, that means that ...