All Questions
Tagged with passwords brute-force
195 questions
-1
votes
1
answer
395
views
bruteforce local software's password
There is a lot of online tools to bruteforce online server like hydra and offline with hashes like hashcat. Yet it seems very weird that there is not a single offline bruteforcing app for software. ...
0
votes
1
answer
192
views
FFUF command returns status code 400, regardless of mode option: clusterbomb, pitchfork, sniper
I'm working on a lab on PortSwigger.com titled Username enumeration via different responses. While using ffuf to solve the lab, the output keeps returning a 400 status code.
So far this is what I've ...
user303027
0
votes
1
answer
239
views
Does 7z or RAR5 offer better resistance to brute force attacks?
Does 7z or RAR5 offer better resistance to brute force attacks?
- 1
0
votes
1
answer
429
views
What's stopping attackers from brute forcing SSH passwords over new sessions?
I know that when you attempt to log in to a device via SSH, upon inputting an incorrect password, you must wait several seconds before you get another attempt. This is obviously a deterrent against ...
- 246
1
vote
1
answer
267
views
Is it secure to expose a salted bcrypt hash IF it is maximum length random secure password?
Is it secure to expose a salted bcrypt hash (minimum 14 cost) if the used password is 72 characters (maximum) byte long, randomly generated letters, numbers, and special characters using secure ...
- 13
0
votes
2
answers
8k
views
Fastest way to brute force SSH
I'm doing a CTF on vulnhub and I need to brute force SSH. I've got 6 usernames and 15.000.000 passwords to try so I'm brute-forcing with hydra by running
hydra -L users.txt -P $LIST/rockyou.txt -t 64 -...
0
votes
1
answer
2k
views
Brute force alphanumeric passwords between 1 to 7 characters long with ZAP
In BurpSuite, you can brute force a password of any length and any character set (in my case, alphanumeric passwords between 1 to 7 characters long). How does one do it in OWASP ZAP, without actually ...
- 3
0
votes
0
answers
104
views
Which password is more secure? [duplicate]
Which password is harder to guess/brute-force:
onlysmallletters!
Ez65);k
And also, can you explain your answer?
- 101
0
votes
0
answers
180
views
Allow for login through Tor while preventing brute force/distributed password attacks?
I am making a website with the goal of blocking bots that are trying to login from different IP addresses constantly... while still allowing regular users to login via Tor.
One of the approaches to ...
24
votes
7
answers
11k
views
After a password leak, is there a Levenshtein distance from which one a newly derivated password can be considered safe?
After a password leak, is there a Levenshtein distance from which one a newly derivated password can be considered safe?
I assume yes, given that if e.g. the word was "password", and the new ...
- 452
0
votes
1
answer
294
views
ncrack ssl option
There is the following option in ncrack (from the man page):
Misc options:
ssl: enable SSL over this service
ssl (Enable/Disable SSL over service)
By enabling SSL, Ncrack will try to open a TCP ...
- 282
0
votes
1
answer
133
views
If a platform/system has brute force protection should I care for a very strong password
If a platform has brute force protection should I worry about creating a very strong password since any attacker would not get a chance to reach enough attempts to crack even the weakest password?
Not ...
- 103
0
votes
2
answers
1k
views
How does having a password hash speed up cracking vs not having a hash (on-site)?
On Windows, user password hashes are not salted and, on Linux, user password hashes are stored in the same root-owned file as the salt. Given this, in what ways might a bruteforce attack to find the ...
- 331
1
vote
2
answers
3k
views
How to generate all possible combinations of a forgotten password
I have forgotten my password but I know the words used in the password. I remember the password was something like [email protected].
Is there any software that can produce all combinations like ...
- 11
1
vote
0
answers
564
views
Hardware for password cracking
I'm planning to extend my pentest services to Password Cracking, to be more precise: Cracking Active Directory Passwords, extracted from the customers Active Directory in order to check users ...
- 129
1
vote
1
answer
2k
views
In Hashcat, How to generate combinatior attacks consisting of more than two words (in lenght)?
I am trying to make a combinator attack using just one dictionary:
word1
word2
word3
word4
word5
...
And would like to try all 4-words-length permutations separated by commas:
word1,word2,word3,word4
...
- 113
0
votes
0
answers
151
views
Isn't this kind of password ultimately secure and insanely easy to remember? [duplicate]
Pick any dictionary word.
Think of a number over 10 and below 20.
Repeat the word as many times as the number, and end off with the same number (for example, "12").
Example:
...
- 1
0
votes
2
answers
589
views
How do I brute-force a password when I know the format? [closed]
The format is 1 letter + 5 numbers (e.g. A12345).
Any method and software?
user242064
5
votes
2
answers
3k
views
Does brute-force time depend on the length of a password only? [duplicate]
If a password is +30 characters long but contains words from the dictionary, is it less secure than a 10-character password that is !@#$#%$^%$, for example?
- 59
4
votes
2
answers
7k
views
Is it feasible to recover a zip file password consisting of about 16 digits?
A friend of mine lost the password of a zip file of her. She remembers that the password contains digits only (that is, only 0, 1, 2, 3, 4, 5, 6, 7, 8, and 9) and is 16 characters long or so. The ...
- 195
0
votes
1
answer
184
views
Getting encrypted password
I have seen many hackers bruteforce password for gaining access to social media.
In famous Mr Robot series it is shown that Elliot(main character) brute forces people and the password is displayed on ...
- 51
0
votes
1
answer
623
views
How does winrar know I typed the right key?
As far as I know WinRar uses the password you type and derives the key from it. But how exactly does it check if the key I typed is correct? What I think is that it compares your guess with the right ...
- 113
2
votes
1
answer
216
views
How can one mitigate both account-level DOS attacks and online brute force attacks at the same time?
I was recently reading this question, where the accepted answer claims that it is easy for attackers to bypass rate limiting that is based on IP, which makes any sort of IP rate limiting to prevent a ...
- 225
-3
votes
1
answer
1k
views
Bruteforcing a Wi-FI password [closed]
Is it possible to brute-force a WiFi password, since technically there are no limits with login attempts?
If there is any, the MAC address of the attacker device can be changed.
- 21
2
votes
1
answer
949
views
Is better to have as password a sentence or first letter of the sentence?
Which is better master KeePass password to prevent any type of bruteforce between theses two type of password :
Complete sentence invented by user like : I like cheeseburger,
tomatoes and fries ! :)
...
- 274
1
vote
1
answer
277
views
Does digested passwords send over a non encrypted channel offers additional security over plain text passwords?
I am learning about WS-Security and trying to compare different options offered by UsernameToken as described in this document.
AFAIK, a digested password is a hash of the plain text password along ...
- 133
2
votes
1
answer
552
views
How do attacks on password locked accounts work?
A lot of questions here are about the safety of passwords e.g a Login Password to an account on site X. But how can attackers get in the account when they have to guess the passwords? I know there is ...
- 23
13
votes
5
answers
8k
views
Defense against attacks using dictionaries
Some forms of attacks on passwords use dictionaries. It is safer to use nonsense passwords like YunSUanLin, Artibichoke, etc., which do not seem to pertain to any dictionary?
- 131
5
votes
1
answer
4k
views
How secure is KeePass KDBX4 by default?
How secure is KeePass KDBX4 by default if someone obtain the .kdbx file and attempt to brute-force it without knowing any hint of the master password?
With assumption :
The password length is equal/...
- 53
9
votes
1
answer
3k
views
What local resources are used when bruteforcing a remote service?
What pc resources are used when bruteforcing ?
I mean bruteforcing something online, not hashes.
Do you need a good amount a RAM and a good CPU or it's just about the internet speed ?
- 107
1
vote
2
answers
4k
views
How to brute force only username not password?
I want to find the username first, then pass the username and a password list. I could not find flags to ignore password in Ncrack and other related tools. The device I want to find a username is ...
- 11
3
votes
2
answers
746
views
Is using a phrase from a book as a password such a bad idea
I've been told/seen online that choosing a sentence or a phrase from a book and using it as a password is a bad idea. How is this true? Unless the potential attacker knew which book you used I don't ...
- 31
2
votes
2
answers
488
views
Why is it still necessary to block brute-force attacks when passwords hash verification requires significant work?
For authentication controls, Owasp gives advice to prevent brute-force attacks by locking out account, and I see this kind of advice in several places (blocking by source IP after failed logins, ...
- 23
1
vote
1
answer
1k
views
What are the disadvantages of using Shamir's Secret Sharing to implement a Partial Password scheme?
Suppose I want to implement a partial password scheme, where the user authenticates by using two passwords: one a normal password, the other is partial, where he only needs to type the selected three ...
user123540
1
vote
2
answers
10k
views
Brute-Forcing DVWA login page with hydra
I'm learning how to brute force web login pages with a popular brute force tool called "Hydra". I'm using Kali Linux (VirtualBox) to do this. I've installed DVWA (Damn Vulnerable Web Application) and ...
- 11
2
votes
2
answers
2k
views
Are partial passwords a security improvement over full passwords?
With full password authentication, you need to enter the full password every time.
With partial password authentication, you're asked for some subset of the password each time, and which characters ...
- 373
2
votes
1
answer
2k
views
hashcat specific brute force
Is this scenario possible:
I know the first three letters of the password (exact), i know the password is between 10-14 characters, i know the rest of the characters are "b,t,p,1,3,6,7" which can be ...
- 219
0
votes
1
answer
985
views
Is this possible to brute force 25 billions billions password in less than a month?
i'm using Hashcat for a while & try to solve this challenge: is this possible to crack at least half the possibilities combinations password of 10 character using 94 characters from keyboard with ...
2
votes
2
answers
862
views
is there an upper limit on time to brute-force a password, based on acceptable login delay and hardware speed ratios?
Suppose a user uses a password to log in to their PC. When the user logs in, the PC applies a cryptographic function to the password and compares the ciphertext to the stored ciphertext of the known ...
- 653
0
votes
1
answer
4k
views
How can hackers get 1 billion passwords per second?
So I'm interested in Brute Force attacks and I have made them with Python 3 and C++. However, those only reached a max of about 20 million passwords per second.
I know for a fact that 1 billion ...
- 11
3
votes
1
answer
4k
views
How to find out Wi-Fi password with dictionary attack without connecting to the Wi-Fi?
I have some specific problem. Is there any possibility how to find out Wi-Fi password with dictionary attack without connecting to the Wi-Fi?
I need it for my bachelor thesis, where I am using ...
- 31
4
votes
1
answer
9k
views
Should user account be locked after X amount of failed logins?
I have almost finished developing my login system and there is one more thing that I'm not sure about. So many debates I found on the internet about counting invalid logins and locking users account. ...
- 141
1
vote
0
answers
1k
views
Kerberos and brute-force attacks
Suppose that I am the administrator of a system that uses Kerberos and password authentication. How can I make brute-force attacks on user’s passwords by an attacker who can capture network traffic ...
- 889
0
votes
1
answer
432
views
if salt stored in user, will it be possible to use brute force attack? [duplicate]
I had done a lot of research about this topic.
Before Researchs
I found that some people suggest that to hide salt is not important: https://crackstation.net/hashing-security.htm
But also this ...
0
votes
1
answer
1k
views
Are passwords longer than 128 bits useless if hashed with MD5? [duplicate]
Are passwords that are longer than 128 bits useless if they get hashed/transmitted with MD5?
MD5 always uses 128 bits, thus someone would rather try to bruteforce the MD5-hash than the password ...
- 109
15
votes
2
answers
12k
views
Passphrase vs. password entropy
For a while now I have been interested in the passphrase concept as a potentially more secure replacement for classical passwords. My interest stemmed from a gut feeling that passphrases would be of a ...
- 2,751
4
votes
1
answer
3k
views
Wireshark HTTP continuations (Hydra HTTP version)
I am trying to use Hydra to brute force a HTTP POST form page, however the page is returning a HTTP Continuation I'm not sure what that is.
This is being caused by the HTTP/1.0 at the top of the ...
- 251
2
votes
3
answers
1k
views
How secure is a password made up of three or four three-letter words?
According to this, a password such as dinwryran is secure against a brute-force attack. Is this true? If not, why?
- 21
3
votes
1
answer
877
views
Are there bruteforce programs that use letters of other languages? Arabic? Greek?
I came across a site that had the password strength meter. I tried using 'password' and the meter did not like my password. Then I happened to try 'password' but I used the arabic translation for 'a' ...
- 45
1
vote
0
answers
283
views
How easily could a picture password be hacked with brute force? [duplicate]
In Windows 8.1 Microsoft introduced a method to login using gestures over a picture. The picture password is determined by size, position and direction of any combination of circles, straight lines ...
- 185