Questions tagged [brute-force]

An attack using every possible input to attempt to produce the correct output. Typically the method of last resort when no weakness allows the use of a more restricted input set. E.g. trying all possible (or likely) passwords, in an attempt to guess the correct one.

Filter by
Sorted by
Tagged with
0
votes
0answers
122 views

Protect unauthenticated interface from guessing attacks

I am currently encountering a publically available interface; accessible at least via web form/webviews and some stateless protocol (presumably REST). In the past this form allowed you to view your ...
0
votes
0answers
133 views

Hydra returning error: “module option must start with http”

I am trying to brute force a web login password using hydra with the below command: hydra -s 8123 -x 2:8:aA1 -t 16 -m http://192.168.1.193 http-proxy I get [ERROR] module option must start with ...
0
votes
1answer
568 views

Kali Linux Hydra question

Recently a friend of mine coded a website and he asked me to brute force it to test it HTML code of the page trying to use hydra on https://pastebin.com/D2iQXrNb (use Pastebin because I don't know ...
0
votes
1answer
2k views

How do I change my IP Address after a specific number of loops in Python? [closed]

I have a for loop to brute force a Gmail account. But I've heard that Gmail's max attempts is 100. So how do I change my IP after 100 loops? Thanks in advance.
0
votes
1answer
68 views

Attacking encrypted storage vs attacking memory [duplicate]

I want to create a generative password manager. Generative password managers generate passwords based on seeds such as the master password and the website's URL. In contrast, most password managers ...
0
votes
1answer
1k views

Test a known list of possible Windows Remote Desktop credentials?

I've forgotten my password to my home server. It's a new Windows 2012R2 VM, I didn't change the maximum password age requirements in Group Policy DC (even tho I know I should have) until it was too ...
0
votes
0answers
270 views

Would it take long to brute force a md5 hash like this?

1be8917510-36.51929856278002 10bce1af27-99.18403192423284 103fa11cc6-87.21158325206488 Few examples above and as you can see the pattern is: 1xxxxxxxxx-{a percentage (0-100) to 14 decimal places} x ...
0
votes
0answers
228 views

Is the password “Z” more secure than the password “a”? [duplicate]

Okay, I guess it's not possible to call one-letter-passwords "secure" - so let's compare ZZZZZZZZZZ with aaaaaaaaaa. Both are using the same character pool [A-z], so the number of combinations for a ...
0
votes
0answers
43 views

How can I determine the encryption used by knowing input and result? [duplicate]

Is it possible to determine the encryption or hash used if I know the original input and final output? There is a similar post here: Determine encoding/hashing methods used based on knowing the input ...
0
votes
1answer
100 views

Can bruteforce attacks be prevented with tables of valid inputs?

Can this method of encryption prevent bruteforce attacks? If I had a hypothetical table (or function) where every grammatically valid sentence (limited to some number of words) was given an ...
-1
votes
7answers
4k views

Are passwords made up from concatenating a few foreign words better than shorter random characters? [duplicate]

Does it make sense to insert a foreign word into a paraphrase to mitigate against brute force? For example: "pussiMeansCatInEskimo" "caballoMeansHorse" "CatIsGatto" "SalopeMeansBitch" "...
-1
votes
2answers
174 views

How secure is a 4 digit numbers only captcha? [closed]

How secure is a 4 digit numbers only captcha? How many tries will take to be able to bruteforce that captcha?
-1
votes
1answer
751 views

How do I find out how long a password is for a 7zip aes 256 encryption? [closed]

I lost password to a 7zip, nothing important in it. But i'll still like to access it. I heard there is a way to find out how long the password is, but I dont know how.
-1
votes
2answers
5k views

Calculating permutations of a hexadecimal character set [closed]

How long would it take to run through all permutations/combinations of a ten character set; assuming the character-set is limited to a hexadecimal alphabet? (i.e. 16 characters {0..9}{A..F}; eg. ...
-1
votes
1answer
4k views

How long does it take to crack a 100-letter long winrar password? [closed]

i´m interested in how long time it would take for a super computer dedicated to crack to crack a 100-letter long winrar password. The password contains Lowercase, Uppercase, Digits, ...
-1
votes
1answer
96 views

How do hackers acquire large pools of ip addresses to use? [closed]

I've tried googling but can't find a satisfactory answer. Probably looking up the wrong search terms... I see questions on here and other forums that state they have a sophisticated attacker utilizing ...
-1
votes
2answers
408 views

Limiting five letter string to only include words from dictionary in Crunch?

I am creating a word list for attacking a personal .dmg file on OS X. I'm using John the Ripper for the cracking, and Crunch to create the word list: ./crunch 13 13 abcdefghijklmnopqrstuvwxyz ...
-1
votes
1answer
759 views

Is there a benefit to encrypting a file multiple times? [duplicate]

If I had to store a text file with some confidential information on the cloud, would encrypting the file multiple times (say, 3) with different passwords using WinRAR (AES with a 256 bit key) provide ...
-1
votes
1answer
1k views

Where can I find good word list for MySQL 5? [closed]

I wonder where can I find good collections of dictionaries which can be used for MySQL 5 dictionary attack? I just need MySQL 5 word lists / dictionaries. I found a lot of MD5, SHA1, etc. but not ...
-1
votes
1answer
76 views

find out unprotected commonly used subdirectories

I try to solve a pentesting challenge where I have to find out a directory, which is unprotected from directory listing. I tried to find it with wfuzz -c -z file,'wordlist.txt' --hc 404 http://...
-1
votes
1answer
225 views

Spider (web scrawling) vs Force Browsing

I'm scanning websites with OWASP ZAP and noticed that the Spider attack and Force Browse attack return somewhat different results. What are the differences between Web Spiders (Web Crawlers) and ...
-1
votes
1answer
271 views

Subdomain scanner without brute-force attack? [duplicate]

It is possible to scan subdomains of network without brute-force attack? If yes, how it works? I tried to scan the network with some penetrating tools and it returned to me subdomain which doesn't ...
-1
votes
1answer
129 views

Should I blacklist countries to stop brute force attacks?

I'm getting attacks at wp-admin from numerous countries and IPs. When I get a notification from Wordfence that there has been an attack, I blacklist the originating country from the WP backend. Then I ...
-1
votes
1answer
574 views

How to brute-force a login that uses passwords of a specific format? [closed]

For example, if a website login that uses password of a specific format containing 3 letters and 3 numbers like abc123, qwr345, yta921... What tools on Kali Linux can crack this type of password and ...
-1
votes
2answers
3k views

How do I brute-force a WPA-2 wifi with Aircrack-ng in Kali Linux?

What I basically want to do is, perform a test on my Wi-Fi and brute force it instead of a dictionary attack. I googled, and all of them showed me examples of dictionary attack and no bruteforcing. ...
-2
votes
2answers
2k views

Can the U.S. goverment crack encryption? [closed]

Does USA government have the sufficient processing power to crack keys in matter of seconds? Let say 2048-bit RSA, for example. Since the RSA algorithm was developed by USA government (NSA?), I ...
-2
votes
4answers
2k views

Getting password cracking time and byte storage from bruteforce?

I am stuck with this question, you can see it in the picture I have included below. PARTS (a and b) I know a-z will be 26^8, A-Z will be 26^8 guesses, and 0-9 will be 10^8 guesses. But I can't relate ...
-2
votes
1answer
1k views

Directory Traversal or File System Permissions? [closed]

A network administrator discovers several unknown files in the root directory of his Linux FTP server. One of the files is a tarball, two are shell script files, and last one is a binary- file is ...
-2
votes
2answers
913 views

How secure is aes-256-cbc with a 40 char password [closed]

I'm using this command from this article to encrypt a file: openssl enc -aes-256-cbc -in /etc/services -out services.dat -k MYPASSWORD If MYPASSWORD is 40 characters in length, roughly how long ...
-3
votes
1answer
5k views

Time to break SHA-512 [closed]

From https://stackoverflow.com/questions/6776050/how-long-to-brute-force-a-salted-sha-512-hash-salt-provided, to break SHA-512 with brute force strategy, it require 3,17 * 10^64 years. It is almost ...
-3
votes
1answer
203 views

Bruteforcing a Wi-FI password [closed]

Is it possible to brute-force a WiFi password, since technically there are no limits with login attempts? If there is any, the MAC address of the attacker device can be changed.
-3
votes
1answer
670 views

How long does it take to brute force a 7 character long password taken from 16 character set

A database file is encrypted with 256bits AES and the key is the first 7 characters (from the character set 0-9, a - f, all small letter) of MD5 hash . This implies 2^28 bits (268,435,456) possible ...
-3
votes
2answers
2k views

Time it takes to crack a password on site like yahoo [closed]

I have a question. If you were using a password brute force/dictionary attack utility on a site like yahoo or another site, how long would it take to crack a password like Jah13Wootiang if Wootiang is ...
-3
votes
1answer
220 views

How long would it take to brute force a URL path that's 5 characters long

example.com/[a-zA-Z0-9] the code can be any mix of numbers + uppercase/lowercase letters and it's 5 characters. How long would it take to brute force or is there an easier/faster way to do it?
-4
votes
1answer
763 views

Feasibility of brute-force on online password [closed]

I am familiar with how offline brute-force attacks work. But for online accounts, assuming no social engineering, how feasible is it to brute-force attack a password? For example, is this dependent ...
-4
votes
1answer
576 views

How can WPscan bruteforce passwords without hitting any limit rate?

I've just watched this video which shows the attacker bruteforcing both usernames and passwords. How can this be achieved without hitting any limit rate? Does it mean that WordPress doesn't provide ...
-4
votes
1answer
2k views

What makes brute force attack faster? [closed]

My question was, What makes brute force attack faster? Is it a bigger RAM, larger storage or a faster processor... because I saw a video of a man who put 7 GTX 1080's in parallel and it hacked a lot ...
-4
votes
1answer
123 views

Binary Numbers converted to Hexadecimal private key [closed]

Couldn't you use brute force to guess someone’s binary number because it's 1 or 0 - 256 times then just keep switching 1's and 0's around- which then can be converted hexadecimal to guess their ...
-4
votes
1answer
3k views

Hydra brute-force not working [closed]

This is the command I am using and when I press Enter : hydra -L username.txt -P passwords.txt localhost http-post-form "dvwa/login.php:username=^USER^&password=^PASS^&Login="Login Failed" > ...
-4
votes
1answer
495 views

How many possible symbols and punctuations in a password? [closed]

I want to compute the possible combinations of a password consists of 8 digits of: alphabetical letters (26), numbers (0-9), symbols and punctuations. In order to compute this, I have to know the ...
-4
votes
1answer
112 views

Using 128-bits as an input for hashing using SHAKE-3 (128-output)

I would like to know the time estimate for a brute force attack to break my input (128-bit) which means 2^128 possibilities are there. Any online tool for that or any article which talks about that?
-5
votes
1answer
334 views

is there any playground for brute force? [closed]

Is there a site where i can make an account and run my brute forcer to check it for infinite attempts? Something which does a HTTP request and no javascript submit.

1
10 11 12 13
14