All Questions
Tagged with passwords brute-force
195 questions
7
votes
4
answers
2k
views
Is a password easier to brute force if it contains a repeating pattern?
My question is different from this previous question: Does repeating one word to form a password result in a similar pattern in its encrypted format?. I'm specifically wondering about brute force ...
- 2,727
0
votes
1
answer
192
views
FFUF command returns status code 400, regardless of mode option: clusterbomb, pitchfork, sniper
I'm working on a lab on PortSwigger.com titled Username enumeration via different responses. While using ffuf to solve the lab, the output keeps returning a 400 status code.
So far this is what I've ...
CommunityBot
- 1
5
votes
2
answers
10k
views
What are realistic rates for brute force hashing?
I'm trying to gauge password strength assuming that the attacker has a hash of my password. Can anyone cite some realistic contemporary rates at which someone could perform various hashes? I know most ...
- 132k
-1
votes
1
answer
395
views
bruteforce local software's password
There is a lot of online tools to bruteforce online server like hydra and offline with hashes like hashcat. Yet it seems very weird that there is not a single offline bruteforcing app for software. ...
- 12.6k
1
vote
4
answers
2k
views
Creating a wordlist knowing parameters
I need to crack my own router password. Advantage is that I know possible characters and maximum length.
What I need is to create a dictionary. The dictionary should contain all the combos of ...
0
votes
1
answer
239
views
Does 7z or RAR5 offer better resistance to brute force attacks?
Does 7z or RAR5 offer better resistance to brute force attacks?
- 9,717
2
votes
1
answer
216
views
How can one mitigate both account-level DOS attacks and online brute force attacks at the same time?
I was recently reading this question, where the accepted answer claims that it is easy for attackers to bypass rate limiting that is based on IP, which makes any sort of IP rate limiting to prevent a ...
CommunityBot
- 1
6
votes
3
answers
33k
views
Brute force alphanumeric password using JohnTheRipper
I recently recovered a zip archive with some files I need access to, but I can't remember the password. All I can remember is that the password was short (around 3-4 characters), and contained only ...
- 1
28
votes
6
answers
176k
views
Is it possible to brute force all 8 character passwords in an offline attack?
This article states:
Brute-force techniques trying every possible combination of letters, numbers, and special characters had also succeeded at cracking all passwords of eight or fewer characters.
...
- 107
0
votes
1
answer
429
views
What's stopping attackers from brute forcing SSH passwords over new sessions?
I know that when you attempt to log in to a device via SSH, upon inputting an incorrect password, you must wait several seconds before you get another attempt. This is obviously a deterrent against ...
- 19.4k
5
votes
1
answer
1k
views
Non English password dictionaries [closed]
What is a good resource for wordlists used in auditing passwords in non english languages. I have extensive wordlists in English ranging to several GB's, but can't find similar resources for other ...
- 132k
1
vote
1
answer
267
views
Is it secure to expose a salted bcrypt hash IF it is maximum length random secure password?
Is it secure to expose a salted bcrypt hash (minimum 14 cost) if the used password is 72 characters (maximum) byte long, randomly generated letters, numbers, and special characters using secure ...
- 9,717
1
vote
2
answers
10k
views
Brute-Forcing DVWA login page with hydra
I'm learning how to brute force web login pages with a popular brute force tool called "Hydra". I'm using Kali Linux (VirtualBox) to do this. I've installed DVWA (Damn Vulnerable Web Application) and ...
- 132k
139
votes
9
answers
348k
views
Where can I find good dictionaries for dictionary attacks?
I’m wondering where I can find good collections of dictionaries which can be used for dictionary attacks?
I've found some through Google, but I’m interested in hearing about where you get your ...
- 103
0
votes
2
answers
8k
views
Fastest way to brute force SSH
I'm doing a CTF on vulnhub and I need to brute force SSH. I've got 6 usernames and 15.000.000 passwords to try so I'm brute-forcing with hydra by running
hydra -L users.txt -P $LIST/rockyou.txt -t 64 -...
- 132k
15
votes
2
answers
2k
views
Are there some good papers (or discussions) on using Markov chains or Hidden Markov Models for password auditing/cracking?
As a programmer and language enthusiast I've been very interested in Markov chains for some time. Considering the influence of natural language on password and passphrase selection (by humans of ...
- 12.6k
28
votes
4
answers
11k
views
Should I implement incorrect password delay in a website or a webservice?
With arguments expressed in this answer, there is a few seconds delay between user enters an incorrect password and when he/she actually learns, that password was incorrect. This security solution is ...
- 3,689
0
votes
0
answers
180
views
Allow for login through Tor while preventing brute force/distributed password attacks?
I am making a website with the goal of blocking bots that are trying to login from different IP addresses constantly... while still allowing regular users to login via Tor.
One of the approaches to ...
- 67.3k
0
votes
1
answer
2k
views
Brute force alphanumeric passwords between 1 to 7 characters long with ZAP
In BurpSuite, you can brute force a password of any length and any character set (in my case, alphanumeric passwords between 1 to 7 characters long). How does one do it in OWASP ZAP, without actually ...
- 624
3
votes
1
answer
9k
views
How to use multiple charsets in hashcat
I wanted to use a brute force attack on hashcat but WPA/WPA2 networks are 8-64 characters long and they have multiple possibilities of a password. I was wondering if there was a way to use multiple ...
- 1
8
votes
4
answers
9k
views
How can hackers guess passwords (using dictionary attack or brute force) without being locked out?
Nowadays almost every website you want to register in; is asking you to create a complicated password...But why cant we use simple passwords?
I am just wondering because in case of multiple wrong ...
CommunityBot
- 1
0
votes
0
answers
104
views
Which password is more secure? [duplicate]
Which password is harder to guess/brute-force:
onlysmallletters!
Ez65);k
And also, can you explain your answer?
- 132k
24
votes
7
answers
11k
views
After a password leak, is there a Levenshtein distance from which one a newly derivated password can be considered safe?
After a password leak, is there a Levenshtein distance from which one a newly derivated password can be considered safe?
I assume yes, given that if e.g. the word was "password", and the new ...
0
votes
1
answer
294
views
ncrack ssl option
There is the following option in ncrack (from the man page):
Misc options:
ssl: enable SSL over this service
ssl (Enable/Disable SSL over service)
By enabling SSL, Ncrack will try to open a TCP ...
CommunityBot
- 1
0
votes
1
answer
133
views
If a platform/system has brute force protection should I care for a very strong password
If a platform has brute force protection should I worry about creating a very strong password since any attacker would not get a chance to reach enough attempts to crack even the weakest password?
Not ...
- 132k
0
votes
2
answers
1k
views
How does having a password hash speed up cracking vs not having a hash (on-site)?
On Windows, user password hashes are not salted and, on Linux, user password hashes are stored in the same root-owned file as the salt. Given this, in what ways might a bruteforce attack to find the ...
- 331
1
vote
2
answers
3k
views
How to generate all possible combinations of a forgotten password
I have forgotten my password but I know the words used in the password. I remember the password was something like [email protected].
Is there any software that can produce all combinations like ...
CommunityBot
- 1
1
vote
0
answers
564
views
Hardware for password cracking
I'm planning to extend my pentest services to Password Cracking, to be more precise: Cracking Active Directory Passwords, extracted from the customers Active Directory in order to check users ...
CommunityBot
- 1
1
vote
1
answer
2k
views
In Hashcat, How to generate combinatior attacks consisting of more than two words (in lenght)?
I am trying to make a combinator attack using just one dictionary:
word1
word2
word3
word4
word5
...
And would like to try all 4-words-length permutations separated by commas:
word1,word2,word3,word4
...
- 9,717
9
votes
1
answer
11k
views
How to crack 10 digits with prefix password in John the Ripper?
I want to crack a password which pattern was 10 digits start with 0910 or 0912.
So possible passwords would be e.g.
0910333444, 0910444566, 0912111222, 0912145632.
How to configure the incremental ...
- 9,717
0
votes
0
answers
151
views
Isn't this kind of password ultimately secure and insanely easy to remember? [duplicate]
Pick any dictionary word.
Think of a number over 10 and below 20.
Repeat the word as many times as the number, and end off with the same number (for example, "12").
Example:
...
- 132k
2
votes
2
answers
2k
views
Are partial passwords a security improvement over full passwords?
With full password authentication, you need to enter the full password every time.
With partial password authentication, you're asked for some subset of the password each time, and which characters ...
- 352
0
votes
2
answers
589
views
How do I brute-force a password when I know the format? [closed]
The format is 1 letter + 5 numbers (e.g. A12345).
Any method and software?
- 132k
5
votes
2
answers
3k
views
Does brute-force time depend on the length of a password only? [duplicate]
If a password is +30 characters long but contains words from the dictionary, is it less secure than a 10-character password that is !@#$#%$^%$, for example?
- 510
4
votes
1
answer
17k
views
how to get cookies from aspx site to use it with hydra
I've been playing around with Hydra and .aspx site and I've hit a bit of a snag - Hydra responds letting me know that the first 16 passwords in my password list are correct when none of them are.
...
- 132k
0
votes
2
answers
8k
views
Calculating permutations of a hexadecimal character set [closed]
How long would it take to run through all permutations/combinations of a ten character set; assuming the character-set is limited to a hexadecimal alphabet? (i.e. 16 characters {0..9}{A..F}; eg. ...
- 132k
4
votes
2
answers
7k
views
Is it feasible to recover a zip file password consisting of about 16 digits?
A friend of mine lost the password of a zip file of her. She remembers that the password contains digits only (that is, only 0, 1, 2, 3, 4, 5, 6, 7, 8, and 9) and is 16 characters long or so. The ...
- 132k
0
votes
1
answer
184
views
Getting encrypted password
I have seen many hackers bruteforce password for gaining access to social media.
In famous Mr Robot series it is shown that Elliot(main character) brute forces people and the password is displayed on ...
CommunityBot
- 1
0
votes
1
answer
623
views
How does winrar know I typed the right key?
As far as I know WinRar uses the password you type and derives the key from it. But how exactly does it check if the key I typed is correct? What I think is that it compares your guess with the right ...
- 165
22
votes
3
answers
22k
views
How is Gmail susceptible to brute-force attacks?
In the Atlantic article "Hacked!" it says:
My wife’s password was judged as “strong” when she first chose it for use with Gmail. But it was a combination of two short English words followed by ...
- 1,324
3
votes
1
answer
3k
views
Pointers for john the ripper rulesets
I've been pouring over the JtR ruleset documentation and making little progress. I understand how to use it to make various permutations from a given wordlist, that's fine. However, I'm trying to ...
-3
votes
1
answer
1k
views
Bruteforcing a Wi-FI password [closed]
Is it possible to brute-force a WiFi password, since technically there are no limits with login attempts?
If there is any, the MAC address of the attacker device can be changed.
- 491
15
votes
2
answers
12k
views
Passphrase vs. password entropy
For a while now I have been interested in the passphrase concept as a potentially more secure replacement for classical passwords. My interest stemmed from a gut feeling that passphrases would be of a ...
- 1,093
8
votes
4
answers
2k
views
Can using emojis make someone's password safer?
I was just thinking about this the other day, after reading about making safe passwords, you have a few options:
The first would be, adding numbers, or something other than just a word
Password15068 ...
CommunityBot
- 1
2
votes
1
answer
949
views
Is better to have as password a sentence or first letter of the sentence?
Which is better master KeePass password to prevent any type of bruteforce between theses two type of password :
Complete sentence invented by user like : I like cheeseburger,
tomatoes and fries ! :)
...
- 9,717
1
vote
1
answer
277
views
Does digested passwords send over a non encrypted channel offers additional security over plain text passwords?
I am learning about WS-Security and trying to compare different options offered by UsernameToken as described in this document.
AFAIK, a digested password is a hash of the plain text password along ...
- 52.1k
18
votes
3
answers
102k
views
What are the differences between dictionary attack and brute force attack?
Can someone explain the major differences between a Brute force attack and a Dictionary attack. Does the term rainbow table has any relation with these?
CommunityBot
- 1
2
votes
1
answer
552
views
How do attacks on password locked accounts work?
A lot of questions here are about the safety of passwords e.g a Login Password to an account on site X. But how can attackers get in the account when they have to guess the passwords? I know there is ...
- 132k
13
votes
5
answers
8k
views
Defense against attacks using dictionaries
Some forms of attacks on passwords use dictionaries. It is safer to use nonsense passwords like YunSUanLin, Artibichoke, etc., which do not seem to pertain to any dictionary?
- 8,021
5
votes
1
answer
4k
views
How secure is KeePass KDBX4 by default?
How secure is KeePass KDBX4 by default if someone obtain the .kdbx file and attempt to brute-force it without knowing any hint of the master password?
With assumption :
The password length is equal/...
- 5,897