Questions tagged [dictionary]
A dictionary is a list of possible or common password that are used to crack passwords in a brute force attack. Such an attack is known as a dictionary attack.
86
questions
2
votes
0
answers
93
views
Windows AD - Fake User Account with Multiple Passwords to Detect Password Spray
TL;DR
I'm trying to implement a fake user account that has multiple sets of credentials that can be used. Instead of a specific password, any one password from a list of them could be used to ...
- 21
1
vote
0
answers
410
views
How to crack KeePass database when knowing the first part of the master password [duplicate]
I have a KeePass 2.47 database which is protected with a master password and a key file.
I managed to lose the 2nd part of my master password. So, I have access to the database, the key file and the ...
- 111
0
votes
1
answer
398
views
How long would it take to crack hashed password stored in plain sight?
I want to store a password hash in plain sight. If I am using a dictionary to crack an Argon2 hashed password that I am storing in plain sight, how long would it take (assuming my password is ...
3
votes
3
answers
263
views
Is a sufficiently long password unsafe just because it only consists of 2-3 letter long mixed-case dictionary words and numbers?
Entropy/Length/Complexity of a password is pretty straight forward and cant really vary much.
For Dictionary Similarity, i would assume that a software just checks how many characters in a password ...
- 319
1
vote
0
answers
124
views
How to limit number strings with crunch
I'm currently trying to generate a very specific word list. The words generated should go like this:
crunch 9 9 -t @%%%%%%,,-o test.txt
But one of the constraints that I have given myself is that the ...
- 11
24
votes
7
answers
11k
views
After a password leak, is there a Levenshtein distance from which one a newly derivated password can be considered safe?
After a password leak, is there a Levenshtein distance from which one a newly derivated password can be considered safe?
I assume yes, given that if e.g. the word was "password", and the new ...
- 442
0
votes
1
answer
281
views
Are dictionary and rainbow table attacks a subset of brute force attacks or are they seperate?
This is more of a question on the actual use of the terms rather than the definitions, so my question is this:
Are dictionary and rainbow table attacks a type of brute force attack or are they ...
- 103
1
vote
2
answers
2k
views
How to generate all possible combinations of a forgotten password
I have forgotten my password but I know the words used in the password. I remember the password was something like [email protected].
Is there any software that can produce all combinations like ...
- 11
1
vote
1
answer
1k
views
In Hashcat, How to generate combinatior attacks consisting of more than two words (in lenght)?
I am trying to make a combinator attack using just one dictionary:
word1
word2
word3
word4
word5
...
And would like to try all 4-words-length permutations separated by commas:
word1,word2,word3,word4
...
- 113
2
votes
1
answer
508
views
Password generation
I'm trying to generate all possible variation of a password.
The base word is like "PleaseSub!" and I need all possible version of it with uppercase, lowercase, etc.. I know there is ...
- 23
0
votes
2
answers
180
views
Regarding Dictionary Attack
Since most websites will let user retry their password, lets say 3 times in a row, in case of mistype or forgotten password.
Exceeding the set number of retry the account will be locked or timed out.
...
- 1
0
votes
1
answer
296
views
Smaller password lists [closed]
I hack wifi passwords with kali linux on airmon-ng and I make always password lists with crunch but the lists are always too long (I'm talking about <100 PT) and I want to know if is there a ...
2
votes
0
answers
117
views
Making custom wordlists for languages besides English
I'm testing a site whose audience doesn't usually have English as their main language. When it comes to non-English, I consider there to be 3 groups
The target language's alphabet is a subset of the ...
- 3,482
0
votes
0
answers
36
views
Building a dictionary [duplicate]
I want to create a list of passwords to perform dictionary attack. Please show me how to build a password dictionary file. First, I gather information from users like hobbies, date of birth, favorite ...
0
votes
0
answers
21
views
Is it possible to have and use a dynamic dictionary for brute-forcing? [duplicate]
For some reason - totally useless for the question - I have this PDF file with a password I forgot and I have no way to remember. I know for a fact (the person who created and gave me this PDF told me ...
- 1
2
votes
2
answers
2k
views
dictionary attack hashing algorithm
Does the kind of algorithm used to hash passwords have any advantages or disadvantages in a dictionary attack? i.e. SHA256, MD5, etc. or is it just the dictionary that is used by the attacker matters? ...
- 21
0
votes
2
answers
168
views
Will extra rules to my diceware list generation scheme decrease security?
I finished reading the Code Book by Simon Singh, I'm interested in playing with some of the ideas in the book to help increase my own understanding. I don't intend to implement the following in any ...
- 15
0
votes
0
answers
276
views
How to run dirb or gobuster against dynamic html applications with same response data to every request?
I have an application under test. The application response with a simple HTML with a response code 200 to every requests. The HTML contains link tags and script tags which contains necessary js files ...
- 1,452
2
votes
1
answer
2k
views
Is there a difference between a rainbow table and a dictionary attack?
I'm trying to learn a bit more about the different types of attacks but as far as I understand it, a rainbow table is a large collection of prehashed data which is then compared to hashed data ...
- 23
1
vote
0
answers
230
views
Using John the Ripper with custom encryption function
I have a working script done with python to do dictionary attack on a few hashes
import hashlib
def main():
print("Starting...")
users = []
with open('users.txt') as f:
for line ...
- 111
13
votes
5
answers
8k
views
Defense against attacks using dictionaries
Some forms of attacks on passwords use dictionaries. It is safer to use nonsense passwords like YunSUanLin, Artibichoke, etc., which do not seem to pertain to any dictionary?
- 131
3
votes
1
answer
9k
views
Combined-Dictionary attack with hashcat, for 4 words passphrases?
Reading the new advice on password which seems to spead easily (at least in my workplace), I was wondering how to use hashcat for cracking four-word password hashes?
Say I have this hash ...
- 1,351
1
vote
1
answer
337
views
Is there any methods available other than brute force and dictionary attacks?
I am curious to know about the wifi attacks. And I have known a little bit about brute force attack and dictionary attack. Is there any other methods available other than these two...?
- 11
1
vote
2
answers
9k
views
How long does it take to compute hashes using the MD5 hash algorithm? [closed]
1) If one iteration of MD5 takes x seconds, is it safe to assume that n iterations of MD5 takes n * x seconds?
2) Will salted and unsalted versions of md5 hash algorithms take approximately the same ...
- 265
1
vote
1
answer
529
views
What layer does dictionary attacks take place on?
This may be a stupid question, but I'm fairly new to cyber security and networking and I'm looking into different types of attacks. I was wondering if dictionary attacks only took place on the ...
- 13
0
votes
2
answers
5k
views
Generating multi-word passphrases from a wordlist [closed]
As part of pentesting NT hashes where the underlying passwords are minimum 16 characters of length, I have created a wordlist of common words, sports teams, movies, names, years etc. - inspired by the ...
- 33
0
votes
1
answer
2k
views
Can brute force or dictionary attacks be detected when using the WiFi protocol?
Can the WiFi protocol recognize when a brute force or dictionary attack on it is occurring? WiFi gives the user an authentication failed message after entering an incorrect WiFi password several times....
2
votes
1
answer
2k
views
Tools and computer specs for password cracking [closed]
To polish my penetration testing skills I want to attempt to crack NTLM/NTLMv2 hashes (via dictionary/wordlist attack) extracted from Active Directory / SAM database, where the underlying passwords ...
- 33
0
votes
2
answers
862
views
Crunch wordlist with different number of words
I'm trying to generate a wordlist, but I need some help with it. Let's say I execute the command:
crunch 1 1 -p cat dog cow
Crunch will generate the following:
catcowdog
catdogcow
cowcatdog
...
- 111
3
votes
1
answer
4k
views
How to find out Wi-Fi password with dictionary attack without connecting to the Wi-Fi?
I have some specific problem. Is there any possibility how to find out Wi-Fi password with dictionary attack without connecting to the Wi-Fi?
I need it for my bachelor thesis, where I am using ...
- 31
42
votes
1
answer
19k
views
How does the attacker know what algorithm and salt to use in a dictionary attack?
I am curious about password cracking methods like dictionary and brute force attacks. Nowadays passwords are stored as hashes and not plaintext on the server. Then how can the plaintext passwords in ...
- 598
2
votes
2
answers
1k
views
Is it still possible to run an online dictionary attack from a single machine, without anonymisation?
This question concerns dictionary attacks conducted:
Over the Internet, using programs like THC Hydra
Via protocols such as HTTP, FTP and SMTP
I believe I'm right in thinking that: a) due to the ...
- 989
0
votes
1
answer
639
views
RDP Audit Failures Brute Force Attacks
I need some help on tracking the source of these RDP access attempts on our terminal server.
Port 3389 is open on the firewall (I know this is a terrible practice. I don't want to hear advice on ...
3
votes
1
answer
311
views
Using a list of three-letter words with variable capitalization as a DiceWare dictionary
This is partly an exercise to see if I understand passphrase generation from a given dictionary using the DiceWare technique. But also for possible personal usage.
All three-letter word lists I can ...
- 325
1
vote
1
answer
604
views
Passwords - extended dictionary vs dictionary attacks
Taking inspiration from Diceware and the other passphrase generators, I took a dictionary of 20k English words and used a script to generate typos of them, resulting in 7M "words", giving 22.7 bits of ...
- 373
1
vote
1
answer
91
views
How to defend against attacker without affecting other users of same NAT gateway
I am implementing a web service and have a daemon process that notices repeated failed login attempts from any given source. If too many occur the IP address is blocked for a given time.
This is ...
- 525
9
votes
3
answers
9k
views
Which is faster - brute-forcing, or using a dictionary attack that contains all possible permutations?
Assuming a 6-character password uses the mixalphanumeric charset, giving each character a character set of 62 and the entire password a keyspace of 62^6 = 46.6 billion (if my calculations are correct)....
- 989
4
votes
2
answers
1k
views
What's the correct term form a pre-computed table with password/hash pairs?
The table looks like this:
123456 -> asfty18u78t489yh
password -> 89y203rupdifhof
something -> 2r892389n89rfsd
And the idea is that if you have the hash (asfty18u78t489yh), you know ...
- 277
1
vote
2
answers
1k
views
How Generate Custom Dictionary Password list [closed]
I want to generate a password list that has 8 characters like this:
Characters are: Pp|Aa|Ss|Ww|o0|Rr|Dd
First character only can be Pp, second Aa@, .... to end.
How can I make this list using ...
- 13
0
votes
1
answer
1k
views
How to Generate Custom Dictionary For this Password Structure [closed]
I am trying to carry out a dictionary attack for a password that is of this structure:
15 characters
Lowercase letters and 0-9
First a five letter word then 4 numbers, then 6 letter word
Examples of ...
- 513
1
vote
4
answers
2k
views
Creating a wordlist knowing parameters
I need to crack my own router password. Advantage is that I know possible characters and maximum length.
What I need is to create a dictionary. The dictionary should contain all the combos of ...
- 113
-2
votes
1
answer
2k
views
Generating wordlists with upper and lower case with crunch
I'm new to crunch and I want to generate a specific wordlist but I need the appropriate code for it. Let's take 478, 1990, gmgm and first. I want all the combinations of these two numbers and two ...
- 1
5
votes
1
answer
1k
views
Forgot BitLock password- can I use dictionary attack?
I know that password has 10 possible words, but I don't know in which order. Can I write a simple bot and try to brute force the password that way? Is there some lockout time on BitLock?
- 51
4
votes
2
answers
2k
views
How Aircrack reliable is for decrypting password? other alternative?
I'm testing over a Handshake captured file I have (handshake.cap) launching aircrack attacks against it with a lot of dictionaries and bruteforce to decrypt its password, but I don't have a strong ...
- 91
1
vote
1
answer
2k
views
Crunch wordlist
I am trying to set up a wordlist of 8 character words where:
the first letter is a capital 'WXCVBN'
the next three are lower case 'wxcvbn'
the next three are numbers between '123456'
the last ...
- 21
2
votes
1
answer
3k
views
Using crunch, but using words like chars
I would like to generate a wordlist that contains words and 2 digit numbers. I want crunch to shuffle them like 15password15, password15, 15password...
Is there any way I can do that with crunch or ...
- 21
3
votes
6
answers
1k
views
Is it safe to use HMAC with a public key for the purpose of salting?
I would like to store password hashes in a database.
In order to prevent dictionary attacks, I was thinking to use HMAC with a key parameter which is public - like user id. That means the user id ...
- 179
1
vote
0
answers
499
views
Password Strength: Compound Words [duplicate]
I’m familiar with XKCD’s Correct Horse Battery Stable example but I am wondering about one aspect of password strength.
Dictionary words are an easy target for password crackers. If you compound a ...
- 141
0
votes
1
answer
1k
views
Generate a password dictionary from simple information [closed]
Suppose that we are going to perform a dictionary attack to crack the password of a known account. If we have some simple information from the account owner, such as first name, surname, age, date of ...
- 13
-1
votes
2
answers
495
views
Limiting five letter string to only include words from dictionary in Crunch?
I am creating a word list for attacking a personal .dmg file on OS X. I'm using John the Ripper for the cracking, and Crunch to create the word list:
./crunch 13 13 abcdefghijklmnopqrstuvwxyz ...
