Skip to main content

Questions tagged [brute-force]

An attack using every possible input to attempt to produce the correct output. Typically the method of last resort when no weakness allows the use of a more restricted input set. E.g. trying all possible (or likely) passwords, in an attempt to guess the correct one.

Filter by
Sorted by
Tagged with
9 votes
2 answers
55k views

Is it possible to crack a PIN / PUK code on a phone SIM card?

When deploying a mobile phone best practices policy, one of the points which were raised was the requirement for the user to protect his SIM card with a PIN. The theory is that three failed attempts ...
WoJ's user avatar
  • 9,048
9 votes
4 answers
804 views

Are there state-of-the-art techniques or theory specifically for attacking passphrases over passwords?

With passphrases becoming more and more common based on length being more important than complexity, I'm assuming there must be some work going on involving techniques aimed specifically at cracking / ...
hippietrail's user avatar
9 votes
4 answers
6k views

Throttling failed login attempts: exponential timeout? by IP? using a session cookie? captcha?

I'm beginning to think this is not as simple as it looks, and many "accepted" answers here and in SO have alternative answers that criticize them. Here is what I have gathered so far Most of what I ...
Eran Medan's user avatar
9 votes
2 answers
4k views

Blocking Chinese IP addresses

I recently checked one of my servers' auth.log file and noticed some very suspicious activity. I recently shut down my server's ssh daemon, so the logs end on Jan 22, but what I noticed after ...
Honesty's user avatar
  • 93
9 votes
1 answer
2k views

Harden a server against mass SSH DoS attacks

How can a Linux server be protected against an attacker that tries to open a large number of SSH sessions (probably trying to brute force a password) that no ports remain to be able to legitimately ...
donatello's user avatar
  • 193
9 votes
1 answer
352 views

Long running SMTP session

I recently noticed an SMTP session on my server which started when a remote host connected but never seemed to result in any emails being delivered. I could see that it was probably a SPAM site and so ...
John S's user avatar
  • 91
9 votes
1 answer
20k views

Bruteforce with hashcat, how to set the mask properly?

Let's say I've an hash of this type: test::::4e45c7bab093d7011e9b3a5df7d9fa88212beac5ac9c8c47:d6ff3373aa353f3b:123456 I would like to bruteforce it using hashcat, but I'm failing to set the correct ...
MeaMelone's user avatar
9 votes
1 answer
10k views

How to crack 10 digits with prefix password in John the Ripper?

I want to crack a password which pattern was 10 digits start with 0910 or 0912. So possible passwords would be e.g. 0910333444, 0910444566, 0912111222, 0912145632. How to configure the incremental ...
Fhope Cc's user avatar
9 votes
1 answer
372 views

TOTP brute force prevention

Lets use Google Authenticator as example. A 6 digit code is generated every 30 second. Each random attempt has 1/1,000,000 chance of success. Server will usually accept code of ±30s which increased ...
Steve's user avatar
  • 343
9 votes
2 answers
776 views

Do I REALLY need to change my LastPass password?

Last weekend LastPass' network was compromised and that a list of email addresses along with the hashes of the master passwords were stolen. It is being recommended that LastPass users change their ...
cuengi8's user avatar
  • 103
9 votes
1 answer
2k views

How to get and use constantly changing cookie JSESSIONID values in Hydra?

Related: how to get cookies from aspx site to use it with hydra My problem is similar to the above case, I get "20 valid passwords found" but the server I'm trying to brute force sends the header set-...
Yash Kumar's user avatar
9 votes
3 answers
3k views

How to calculate brute forcing times/feasibility for remote attacks to include parallelism?

This is purely a thought exercise. Assume a server which does not implement throttling or lock on failed attempts. The server accepts a username/password request & sends back a Yes/No response. ...
user93353's user avatar
  • 2,052
9 votes
1 answer
12k views

Hydra when redirects

I'm using Hydra and I have trouble with this command: hydra 123.123.123.123 http-form-post \ "/se/login:j_username^USER^&j_password=^PASS^&submit=Log+in:/se/invalidLogin" \ -L /root/...
k1308517's user avatar
  • 1,292
8 votes
5 answers
3k views

Are there any security measures that are resistant to a brute force attack?

I'm not talking in particular about encryption, but security as a whole. Are there any security measures that can be put in place to protect data and/or a system that can withstand even a hypothetical ...
gargantuan's user avatar
8 votes
3 answers
9k views

Safety of Password Hashing Using bcrypt Done on Client Side

I am currently using a technique where I send the username/password in cleartext (using https) to the server, which then does bcrypt and compares to the db. Standard practice. It is considered safe. ...
code ninja's user avatar
8 votes
4 answers
7k views

Can anti-CSRF token prevent bruteforce attack?

I am not much experienced with brute force attacks but I was wondering Suppose, you have a website www.example.com and you want to do brute force attack on that login form but that login form is ...
Deepanshu Singh's user avatar
8 votes
5 answers
3k views

Increased security with keepass

I am using keepass for securing passwords. I have a reasonable password, but if someone got hold of the file I am sure eventually they could brute force it. I was thinking of using a key file as ...
Jeremy French's user avatar
8 votes
3 answers
8k views

Avoiding Brute Force Attacks in a Web Based Login Form

My login form uses Ajax so it doesn't need to reload if the password is wrong. A PHP script process the request and creates the session if the credentials are right. My idea is to have the PHP script ...
Celeritas's user avatar
  • 10.2k
8 votes
5 answers
2k views

Attack vectors for brute-forcing website passwords

When talking about password security, a lot of discussion centers on the risk of a password being guessed in a brute-force attack. For websites where a user has registered an account, what are the ...
jrdioko's user avatar
  • 13.2k
8 votes
3 answers
2k views

time to crack file-encryption password - more than just iteration

I have often seen that takes x amount of time to crack a certain length password. But this just seems to be the amount of time it takes to iterate through all the possibilities. What about the time it ...
wayne_h's user avatar
  • 81
8 votes
4 answers
2k views

Can using emojis make someone's password safer?

I was just thinking about this the other day, after reading about making safe passwords, you have a few options: The first would be, adding numbers, or something other than just a word Password15068 ...
knocked loose's user avatar
8 votes
1 answer
4k views

How to interpret this statement against 4096-bit RSA

While I'd agree that double-sized RSA keys may pose more problems than the gain in security possibly justifies, I am having problems understanding the argument made here: https://gnupg.org/faq/gnupg-...
Hagen von Eitzen's user avatar
8 votes
2 answers
882 views

is it easier to get the original password if you have multiple hashes of it?

Most users tipically use the same password for multiple applications. Let's say all of these applications hash the password in some way. Would it be easier for an attacker to get the original password ...
Carlos Campderrós's user avatar
8 votes
4 answers
9k views

How can hackers guess passwords (using dictionary attack or brute force) without being locked out?

Nowadays almost every website you want to register in; is asking you to create a complicated password...But why cant we use simple passwords? I am just wondering because in case of multiple wrong ...
Identicon's user avatar
8 votes
2 answers
17k views

Automated URL Discovering

I built a simple server containing static files at /files/ and I'm attempting to discover them using automated tools. I'm using wfuzz to brute force on the URL but is that the only way? Is there any ...
jviotti's user avatar
  • 521
8 votes
2 answers
5k views

Is lack of wildcard DNS entry a security vulnerability?

A friend of a friend received an email from a security researcher that looks legit. Researcher submitted several vulnerabilities, one of the them reads like this Vulnerability # ... Title : ...
oleksii's user avatar
  • 1,068
8 votes
1 answer
8k views

Are these access.log entries successful wordpress login attempts?

I am hosting some wordpress sites on an apache 2.4 webserver, and I have discovered thousands of entries in my server logs like this: 221.219.219.248 - - [09/Mar/2015:03:29:25 +1300] "GET /example....
the_velour_fog's user avatar
8 votes
1 answer
7k views

Is there any practical attack on port knocking method?

I was wondering, how can I bypass the port knocking method. Is there any public vulnerability or method for attacking port knocking services? For example: I know an SSH port is behind a port ...
user245630's user avatar
8 votes
3 answers
5k views

NTLMv2 resistance to bruteforcing

I have a question regarding NTLMv2 resistance to password bruteforcing. I know that some modern graphic processors (like Radeon 6990) are able to calculate billions hashes per second and crack NTLM ...
w2323's user avatar
  • 81
8 votes
1 answer
7k views

Bruteforce part of password in TrueCrypt

I own a TrueCrypt container and I can't open it. I remember part of its password. So I want to bruteforce attack on it. I tried many parameters in oclHashCat but none worked (parameter problem). Can ...
Mustafa Chelik's user avatar
8 votes
2 answers
2k views

Apple vs DOJ - how strong is the 10-try wipe brute force barrier?

Out of curiosity and with the hope of helping other beginners and journalists. The current Apple vs DOJ standoff in a nutshell - Apple is resisting DOJ with statements like what they're asking is "...
Multicon's user avatar
8 votes
1 answer
1k views

SSH Brute Force Dictionaries

Request for logs please. So, I had an interesting question posed to me around geographical trends in SSH brute force attempts. The question being "has anybody ever looked into the prevalent SSH ...
David Stubley's user avatar
7 votes
4 answers
9k views

Is a randomly generated 80-bit password strong enough nowadays?

Theoretical question - Say we have a randomly generated password with 80-bit entropy, stored as a single-round, unsalted SHA256 hash. For a determined attacker with current (2024) technology, what ...
user13525's user avatar
7 votes
3 answers
4k views

Why is it harder to brute force an iphone than a zip-file?

Having only 1,000,000 possible combinations, an encrypted zip-file with a 6-digit numeric password, could be brute force cracked within a second. But for an iphone (let's say iOS9 if it matters), it ...
Allen's user avatar
  • 97
7 votes
3 answers
2k views

It is possible that brute force attempts are successful before the worst case, correct?

When I read about a password being secure and stating that it would take X amount of week, years, etc. isn't that referring to the worst case? What happens if the brute force method is successul in ...
Mark Norgren's user avatar
7 votes
3 answers
2k views

Why do we have such big keys?

In Chapter 7 of Applied Cryptography, Bruce Schneier claims that, due to thermodynamic limitations, "brute-force attacks against 256-bit [symmetric] keys will be infeasible until computers are built ...
KnightOfNi's user avatar
  • 2,287
7 votes
3 answers
2k views

How to (further) ensure SSH security?

I set up my Linux Ubuntu machine as an SSH server through no-ip.com and it works great. Recently I discovered the command, sudo lastb -ad -F -w which outputs a log of the most recent failed SSH ...
khaverim's user avatar
  • 173
7 votes
5 answers
68k views

How long would it take to bruteforce an AES-128 protected pdf knowing the key is 20 letter long and that the charset is A-Z,0-9?

The question says everything, knowing that a pdf is protected using standard Adobe password encryption that comes with Acrobat Pro (which as far as i know is AES 128) how much would it take to ...
Blobber's user avatar
  • 71
7 votes
4 answers
6k views

Are there lists of most common words or ngrams used in passwords and passphrases?

I've been thinking about ways to focus brute forcing dictionary attacks on passwords and passphrases based on the assumption that certain words, combinations of letters, and combinations of words are ...
hippietrail's user avatar
7 votes
2 answers
4k views

Dictionary Attack on Wifi

I know a few people with pretty weak passwords. What kind of systems exist to prevent dictionary attacks? Would it make sense to restrict the number of connection attempts in a certain timeframe? ...
Lucas's user avatar
  • 1,411
7 votes
2 answers
16k views

Can DES-based hashed password be recovered if salt is known?

Can a hashed password be recovered if the hashing is done with DES based crypt function in PHP and both the hash and salt are known by the attacker? Consider the following example: $salt = 'mysalt'; ...
luben's user avatar
  • 918
7 votes
3 answers
3k views

Known Password Lengths and security considerations [duplicate]

Many people wil often brag about the length of their password, like "yeah nobody is ever going to crack my password cause its 22 characters long." I was thinking, if you knew the exact length of their ...
user488244's user avatar
7 votes
2 answers
22k views

Cracking a password Protected pdf file using John the ripper

What exactly happens after I provide the hash from the pdf file to John for cracking the password? Does John extract just the password hash from the file and work on it, or is there something else?
rats20's user avatar
  • 119
7 votes
1 answer
4k views

How secure is Scrypt, really?

I've been recently taking a hard look at the scrypt system for storing users' passwords. However, I'm rather worried about it's security because of things like Litecoin miners. Is scrypt secure ...
Kaz Wolfe's user avatar
  • 382
7 votes
1 answer
2k views

Why brute-force the password instead of the key directly?

This answer on another question on security stackexchange by a very reputed user explains why he prefers GnuPG over OpenSSL for file encryption. From what I understand, it can be summarized as this: ...
Gradient's user avatar
  • 225
7 votes
1 answer
3k views

Brute force login attempt from spoofed IP's

I see that many of my WordPress installs are being hit with 1000+ failed login attempts using non-existing 'admin' account name. The requests come from different IP's every time, and I see IP's such ...
mikkelbreum's user avatar
7 votes
1 answer
2k views

How resistant is the iPhone encryption against brute-force attacks?

I just read the following paragraph in an article from the New York Times about Apple encrypting iPhones by default): Breaking the code, according to an Apple technical guide, could take “more than ...
Mad Scientist's user avatar
7 votes
2 answers
8k views

How can we protect signup APIs from brute force registration?

This is a general question but its prompted by a fairly open API I have for a file storage service that needs to have its front door better locked down. We have an API like POST '/signup' that just ...
user's user avatar
  • 191
7 votes
2 answers
14k views

Estimated cost to make a brute-force WPA2 attack feasible

It's been shown that a brute-force attack on WPA2-Personal is possible in a reasonable amount of time. These successful attacks appear to be limited, however, to researchers who have the budget to ...
T. Webster's user avatar
  • 2,379
7 votes
2 answers
1k views

Is there an equivalent of an Apple cryptochip in Android devices?

Apple has a cryptochip which, beside managing the encryption keys, tunnels authentication and provides throttling of failed attempts, as well as the ability to trigger a device wipe after several ...
WoJ's user avatar
  • 9,048

1 2
3
4 5
16