All Questions
Tagged with passwords brute-force
55 questions
126
votes
10
answers
18k
views
How critical is it to keep your password length secret?
Is keeping your password length secret critical to security?
Does someone knowing that you have a password length of say 17 make the password drastically easier to brute force?
- 2,617
43
votes
9
answers
9k
views
Do non-keyboard characters make my password less susceptible to brute forcing?
I can put characters in my password for which there are no keys on a keyboard. On Windows, Alt+#### (with the numpad) inserts the character for whatever code you type in.
When I put this in a ...
- 1,782
26
votes
5
answers
12k
views
What's the practical limit for rainbow-table based bruteforce?
Say we have a hash of a password. The password can be considered to be made of of totally random characters and has a fixed length of N. The hash is SHA1(password+salt), where the salt is of length M. ...
- 866
28
votes
6
answers
176k
views
Is it possible to brute force all 8 character passwords in an offline attack?
This article states:
Brute-force techniques trying every possible combination of letters, numbers, and special characters had also succeeded at cracking all passwords of eight or fewer characters.
...
6
votes
8
answers
3k
views
Does it take longer to brute force a password starting with z than one starting with a?
I was wondering about the following:
If someone tries to get my password with Brute Force, will a password starting with "a" guessed faster than one starting with "z" ?
In this case assume the ...
- 181
26
votes
5
answers
2k
views
What concrete parameters can I change to make my passphrase-protected private gpg key more secure
There are several questions which discuss the resistance of passphrase-protected private gpg keys against brute force attacks. It seems, this kind of discussion could go on forever.
Rather than ...
- 1,771
22
votes
5
answers
120k
views
How to generate dictionary for a dictionary attack?
I need to crack my own password. Advantage is that I know possible characters and maximum length.
What I need is to create a dictionary. The dictionary should contain all the combos of characters ...
- 323
9
votes
1
answer
21k
views
Bruteforce with hashcat, how to set the mask properly?
Let's say I've an hash of this type:
test::::4e45c7bab093d7011e9b3a5df7d9fa88212beac5ac9c8c47:d6ff3373aa353f3b:123456
I would like to bruteforce it using hashcat, but I'm failing to set the correct ...
- 93
36
votes
2
answers
44k
views
Why are GPUs so good at cracking passwords?
What is it about GPUs that lets them crack passwords so quickly?
It seems like the driving force behind adopting good key-derivation functions for passwords (bcrpyt, PBKDF2, scrypt) instead of ...
- 465
11
votes
4
answers
3k
views
Password entropy in layman's terms
Entropy is a term used often in relation to password security and brute-force attacks, but it is a topic that can get complicated quickly. What is the best way to describe password entropy (what it is ...
- 13.2k
6
votes
4
answers
1k
views
Can't brute force password cracking somehow be throttled?
Online articles mention the importance of a strong password and suggest that hacking tools allows bad guys to attempt millions of passwords per second. I am wondering why OSes and websites and such ...
- 423
5
votes
2
answers
10k
views
What are realistic rates for brute force hashing?
I'm trying to gauge password strength assuming that the attacker has a hash of my password. Can anyone cite some realistic contemporary rates at which someone could perform various hashes? I know most ...
- 175
139
votes
9
answers
348k
views
Where can I find good dictionaries for dictionary attacks?
I’m wondering where I can find good collections of dictionaries which can be used for dictionary attacks?
I've found some through Google, but I’m interested in hearing about where you get your ...
- 16.2k
28
votes
4
answers
11k
views
Should I implement incorrect password delay in a website or a webservice?
With arguments expressed in this answer, there is a few seconds delay between user enters an incorrect password and when he/she actually learns, that password was incorrect. This security solution is ...
- 3,689
20
votes
4
answers
309k
views
Wordlists on Kali Linux?
I notice that in /usr/share/wordlists in Kali Linux (former Backtrack) there are some lists. Are they used to bruteforce something? Is there specific list for specific kind of attacks?
- 383
18
votes
3
answers
102k
views
What are the differences between dictionary attack and brute force attack?
Can someone explain the major differences between a Brute force attack and a Dictionary attack. Does the term rainbow table has any relation with these?
- 2,097
15
votes
2
answers
2k
views
Are there some good papers (or discussions) on using Markov chains or Hidden Markov Models for password auditing/cracking?
As a programmer and language enthusiast I've been very interested in Markov chains for some time. Considering the influence of natural language on password and passphrase selection (by humans of ...
- 582
14
votes
2
answers
11k
views
Why limit passwords to ascii printable characters? [duplicate]
Possible Duplicate:
Do non-keyboard characters make my password less susceptible to brute forcing?
Every article on password security that I read tells people to make the password more ...
- 455
12
votes
1
answer
41k
views
How long to brute-force WPA password?
Bob has a password (for his WPA encrypted wifi) which is 8 characters, all lowercase, and not a dictionary word.
Eve lives next door to Bob and wants to illegally hack his WPA. The number of ...
- 2,084
12
votes
2
answers
3k
views
Zip file with two password
I used this command to password protect a zip file on Linux :
zip -P 9000 hash.zip hash.py
and it creates the zip file just fine, then I wrote a program to test every possible password on it from 1 ...
user13934
9
votes
3
answers
10k
views
Which is faster - brute-forcing, or using a dictionary attack that contains all possible permutations?
Assuming a 6-character password uses the mixalphanumeric charset, giving each character a character set of 62 and the entire password a keyspace of 62^6 = 46.6 billion (if my calculations are correct)....
- 979
6
votes
4
answers
3k
views
Brute-force heuristics used in password cracking
Existing questions on this site discuss some of the heuristics used by password cracking tools to avoid doing a completely naive brute-force search (for example, "dictionary word with number ...
- 13.2k
5
votes
2
answers
2k
views
Web & insecure HTTP - Using RSA for encrypting passwords on the client side
I used client side password hashing in my register and login project.
Its purpose is to prevent passive adversaries/eavesdroppers from discovering users' plaintext passwords when HTTP requests are in ...
- 2,997
5
votes
1
answer
1k
views
Non English password dictionaries [closed]
What is a good resource for wordlists used in auditing passwords in non english languages. I have extensive wordlists in English ranging to several GB's, but can't find similar resources for other ...
- 3,606
5
votes
3
answers
3k
views
Perfectly Robust Hashing Scheme, or Completely Over-Engineered?
This is going to get long, so prepare. Basis of the question is, Do all these steps improve security, or am I completely overthinking the problem? Are my assumptions/thought process valid?
We all ...
- 251
1
vote
2
answers
10k
views
Brute-Forcing DVWA login page with hydra
I'm learning how to brute force web login pages with a popular brute force tool called "Hydra". I'm using Kali Linux (VirtualBox) to do this. I've installed DVWA (Damn Vulnerable Web Application) and ...
- 11
1
vote
4
answers
2k
views
Creating a wordlist knowing parameters
I need to crack my own router password. Advantage is that I know possible characters and maximum length.
What I need is to create a dictionary. The dictionary should contain all the combos of ...
- 113
0
votes
7
answers
4k
views
Are passwords made up from concatenating a few foreign words better than shorter random characters? [duplicate]
Does it make sense to insert a foreign word into a paraphrase to mitigate against brute force? For example:
"pussiMeansCatInEskimo"
"caballoMeansHorse"
"CatIsGatto"
"SalopeMeansBitch"
"...
- 2,053
27
votes
11
answers
12k
views
Best password strength checker
In XKCD #936: Short complex password, or long dictionary passphrase? Jeff claimed that password cracking with "dictionary words separated by spaces", or "a complete sentence with punctuation", or "...
- 2,789
21
votes
5
answers
8k
views
Would allowing shorter passwords sometimes be more secure?
Does the act of requiring certain criteria for passwords make them easier to brute-force?
It's always seemed to me that when websites limit the use of "insecure" passwords, it might make it easier ...
- 313
15
votes
2
answers
12k
views
Passphrase vs. password entropy
For a while now I have been interested in the passphrase concept as a potentially more secure replacement for classical passwords. My interest stemmed from a gut feeling that passphrases would be of a ...
- 2,751
11
votes
1
answer
40k
views
Hydra bruteforce and JSON
I am having problems with Hydra and a JSON payload.
The login request (intercepted with Fiddler), is the following:
POST http://architectureservice.test.com/api/v1/login HTTP/1.1
Host: ...
- 5,493
9
votes
4
answers
819
views
Are there state-of-the-art techniques or theory specifically for attacking passphrases over passwords?
With passphrases becoming more and more common based on length being more important than complexity, I'm assuming there must be some work going on involving techniques aimed specifically at cracking / ...
- 582
8
votes
5
answers
2k
views
Attack vectors for brute-forcing website passwords
When talking about password security, a lot of discussion centers on the risk of a password being guessed in a brute-force attack. For websites where a user has registered an account, what are the ...
- 13.2k
8
votes
3
answers
2k
views
time to crack file-encryption password - more than just iteration
I have often seen that takes x amount of time to crack a certain length password. But this just seems to be the amount of time it takes to iterate through all the possibilities. What about the time it ...
- 81
8
votes
2
answers
891
views
is it easier to get the original password if you have multiple hashes of it?
Most users tipically use the same password for multiple applications. Let's say all of these applications hash the password in some way. Would it be easier for an attacker to get the original password ...
7
votes
4
answers
6k
views
Are there lists of most common words or ngrams used in passwords and passphrases?
I've been thinking about ways to focus brute forcing dictionary attacks on passwords and passphrases based on the assumption that certain words, combinations of letters, and combinations of words are ...
- 582
7
votes
1
answer
2k
views
Why brute-force the password instead of the key directly?
This answer on another question on security stackexchange by a very reputed user explains why he prefers GnuPG over OpenSSL for file encryption. From what I understand, it can be summarized as this:
...
- 225
5
votes
2
answers
2k
views
Slowing down repeated password attacks
I've been reading suggestions to use time-consuming formulas for checking passwords from login attempts, so that repeated attacks will be slowed down.
Wouldn't it suffice to just sleep a bit in the ...
- 1,821
5
votes
4
answers
7k
views
Brute force vs other methods of recovering passwords from shadow file
Do you know any good approach for de-hashing/actually bruteforcing hashed passwords in the shadow file?
On various operating systems, any good solutions/methods/programs.
Or is it better to upload ...
- 51
4
votes
3
answers
801
views
Could using a generated key from an online service be considered a risk?
With some colleagues we're having a debate regarding the randomkeygen.com website.
I do think that there is a security risk using the generated keys of this (or any of this kind) website.
Why ? ...
- 151
4
votes
1
answer
17k
views
how to get cookies from aspx site to use it with hydra
I've been playing around with Hydra and .aspx site and I've hit a bit of a snag - Hydra responds letting me know that the first 16 passwords in my password list are correct when none of them are.
...
- 43
4
votes
1
answer
2k
views
Will using unicode chars in my password increase security? [duplicate]
Possible Duplicate:
Do non-keyboard characters make my password less susceptible to brute forcing?
Bruteforce tries cracking the hash with every possible combination of letters.
Then, If I'll ...
- 143
4
votes
4
answers
1k
views
Insecure to require numbers in passwords?
Earlier, I went to a site that required a number and special character, and it got me thinking – wouldn't that make the password easier to brute force? If you assume most passwords have around 12 ...
- 171
3
votes
1
answer
20k
views
How long it will take to crack a RAR password?
I wonder how long it will take to crack 16 character alphanumeric WinRAR password for a mini supercomputer. As far as I know graphic cards are preferred over CPUs to crack passwords nowadays. If we ...
- 415
3
votes
1
answer
3k
views
Pointers for john the ripper rulesets
I've been pouring over the JtR ruleset documentation and making little progress. I understand how to use it to make various permutations from a given wordlist, that's fine. However, I'm trying to ...
- 133
2
votes
2
answers
12k
views
How to recover a lost zip file password (Extract Zip Spec '2.0')
I want to recover my backup file, but I can't find the password. The password contains 12-20 characters (As!@$123)
user@PC:/media/user/MyData$ zipdetails -v backup2.zip
0000000 0000004 50 4B 03 04 ...
- 41
2
votes
2
answers
768
views
Temporarily save failed logins password hashes for using against brute force attack
My question is about online brute force attacks, that try to authenticate in the website.
1) For the first case if the requests are coming from the same ip, I think this are relatively easy as after ...
- 485
2
votes
1
answer
3k
views
Brute-Force GPU Password Crackers
Brute-force password cracker programs which claim GPU support include John the Ripper, ighashgpu, oclHashcat, and others. oclHashcat appears one of the more popular, but I am not sure which AMD/ATI ...
- 2,379
2
votes
1
answer
5k
views
What is the recommended length for a phone PIN?
I recently read that you're supposed to have a phone pin consisting of at least six digits. Why?
I'd get it if the pin was stored as a hash in a database, even though six digits would easily be ...
