All Questions
Tagged with passwords brute-force
195 questions
139
votes
9
answers
348k
views
Where can I find good dictionaries for dictionary attacks?
I’m wondering where I can find good collections of dictionaries which can be used for dictionary attacks?
I've found some through Google, but I’m interested in hearing about where you get your ...
- 16.2k
126
votes
10
answers
18k
views
How critical is it to keep your password length secret?
Is keeping your password length secret critical to security?
Does someone knowing that you have a password length of say 17 make the password drastically easier to brute force?
- 2,617
43
votes
9
answers
9k
views
Do non-keyboard characters make my password less susceptible to brute forcing?
I can put characters in my password for which there are no keys on a keyboard. On Windows, Alt+#### (with the numpad) inserts the character for whatever code you type in.
When I put this in a ...
- 1,782
36
votes
7
answers
9k
views
Is it possible to improve brute-force guessing of a password with a picture of the keyboard used to enter it?
Is it a bad idea to post a photo of your keyboard to social media?
Can I look at a photo of a keyboard and determine the password of an account?
Assuming a certain (set of) password(s) is the most ...
- 515
36
votes
2
answers
44k
views
Why are GPUs so good at cracking passwords?
What is it about GPUs that lets them crack passwords so quickly?
It seems like the driving force behind adopting good key-derivation functions for passwords (bcrpyt, PBKDF2, scrypt) instead of ...
- 465
30
votes
5
answers
3k
views
What are the security implications of storing password blacklist?
I want to add a password blacklist that would prevent the 1000 most common passwords from being used in order to mitigate shallow dictionary attacks. Is there any negative implication of storing this ...
- 553
28
votes
6
answers
176k
views
Is it possible to brute force all 8 character passwords in an offline attack?
This article states:
Brute-force techniques trying every possible combination of letters, numbers, and special characters had also succeeded at cracking all passwords of eight or fewer characters.
...
28
votes
4
answers
11k
views
Should I implement incorrect password delay in a website or a webservice?
With arguments expressed in this answer, there is a few seconds delay between user enters an incorrect password and when he/she actually learns, that password was incorrect. This security solution is ...
- 3,689
27
votes
11
answers
12k
views
Best password strength checker
In XKCD #936: Short complex password, or long dictionary passphrase? Jeff claimed that password cracking with "dictionary words separated by spaces", or "a complete sentence with punctuation", or "...
- 2,789
26
votes
5
answers
12k
views
What's the practical limit for rainbow-table based bruteforce?
Say we have a hash of a password. The password can be considered to be made of of totally random characters and has a fixed length of N. The hash is SHA1(password+salt), where the salt is of length M. ...
- 866
26
votes
5
answers
2k
views
What concrete parameters can I change to make my passphrase-protected private gpg key more secure
There are several questions which discuss the resistance of passphrase-protected private gpg keys against brute force attacks. It seems, this kind of discussion could go on forever.
Rather than ...
- 1,771
24
votes
7
answers
11k
views
After a password leak, is there a Levenshtein distance from which one a newly derivated password can be considered safe?
After a password leak, is there a Levenshtein distance from which one a newly derivated password can be considered safe?
I assume yes, given that if e.g. the word was "password", and the new ...
- 452
22
votes
5
answers
120k
views
How to generate dictionary for a dictionary attack?
I need to crack my own password. Advantage is that I know possible characters and maximum length.
What I need is to create a dictionary. The dictionary should contain all the combos of characters ...
- 323
22
votes
3
answers
22k
views
How is Gmail susceptible to brute-force attacks?
In the Atlantic article "Hacked!" it says:
My wife’s password was judged as “strong” when she first chose it for use with Gmail. But it was a combination of two short English words followed by ...
- 349
21
votes
5
answers
8k
views
Would allowing shorter passwords sometimes be more secure?
Does the act of requiring certain criteria for passwords make them easier to brute-force?
It's always seemed to me that when websites limit the use of "insecure" passwords, it might make it easier ...
- 313
20
votes
4
answers
309k
views
Wordlists on Kali Linux?
I notice that in /usr/share/wordlists in Kali Linux (former Backtrack) there are some lists. Are they used to bruteforce something? Is there specific list for specific kind of attacks?
- 383
19
votes
7
answers
1k
views
Are common passwords at particular risk?
The question Should we disallow common passwords like “password” and “12345”? on User Experience immediately made me think that these common passwords were extremely dangerous not because they are ...
- 812
18
votes
3
answers
102k
views
What are the differences between dictionary attack and brute force attack?
Can someone explain the major differences between a Brute force attack and a Dictionary attack. Does the term rainbow table has any relation with these?
- 2,097
15
votes
3
answers
3k
views
Are HTTP brute-force password-guessing attacks common nowadays?
Are brute-force attacks against online accounts (gmail, facebook, instagram) something that really happens? I don't mean something like cracking password hashes or DDoS, but real brute-force attacks (...
- 535
15
votes
2
answers
2k
views
Are there some good papers (or discussions) on using Markov chains or Hidden Markov Models for password auditing/cracking?
As a programmer and language enthusiast I've been very interested in Markov chains for some time. Considering the influence of natural language on password and passphrase selection (by humans of ...
- 582
15
votes
2
answers
12k
views
Passphrase vs. password entropy
For a while now I have been interested in the passphrase concept as a potentially more secure replacement for classical passwords. My interest stemmed from a gut feeling that passphrases would be of a ...
- 2,751
14
votes
3
answers
21k
views
Cracking MS-CACHE v2 hashes using GPU
As most people here will know, Windows caches domain/AD credentials in a format known as MS-Cache v2. Obviously, these would be excellent passwords to gain during a penetration test when local access ...
- 11.5k
14
votes
2
answers
11k
views
Why limit passwords to ascii printable characters? [duplicate]
Possible Duplicate:
Do non-keyboard characters make my password less susceptible to brute forcing?
Every article on password security that I read tells people to make the password more ...
- 455
13
votes
5
answers
8k
views
Defense against attacks using dictionaries
Some forms of attacks on passwords use dictionaries. It is safer to use nonsense passwords like YunSUanLin, Artibichoke, etc., which do not seem to pertain to any dictionary?
- 131
12
votes
2
answers
3k
views
Zip file with two password
I used this command to password protect a zip file on Linux :
zip -P 9000 hash.zip hash.py
and it creates the zip file just fine, then I wrote a program to test every possible password on it from 1 ...
user13934
12
votes
1
answer
41k
views
How long to brute-force WPA password?
Bob has a password (for his WPA encrypted wifi) which is 8 characters, all lowercase, and not a dictionary word.
Eve lives next door to Bob and wants to illegally hack his WPA. The number of ...
- 2,084
11
votes
4
answers
3k
views
Password entropy in layman's terms
Entropy is a term used often in relation to password security and brute-force attacks, but it is a topic that can get complicated quickly. What is the best way to describe password entropy (what it is ...
- 13.2k
11
votes
2
answers
479
views
How much security is compromised if we accept other characters as login (other than the original password)?
I've just realised that facebook accepts 3 forms of a password:
Source:
Facebook actually accepts three forms of your password:
Your original password.
Your original password with the ...
- 3,343
11
votes
1
answer
40k
views
Hydra bruteforce and JSON
I am having problems with Hydra and a JSON payload.
The login request (intercepted with Fiddler), is the following:
POST http://architectureservice.test.com/api/v1/login HTTP/1.1
Host: ...
- 5,493
10
votes
7
answers
3k
views
How can I prevent users from using bad passwords in my web application?
There is a long discussion on whether it's the responsibility of the user or the system administrator to deal with the strength of the password. Obviously, the password is a very private thing, but ...
- 593
10
votes
4
answers
5k
views
Can ssh keyfile security be broken in a few hours if the file is exposed?
At this link there is a claim that if an RSA key has a strong passphrase security might be broken in a few hours if an attacker has the private key.
Is there something weak about the security of RSA ...
- 953
10
votes
3
answers
7k
views
Can I spoof IP addresses when attempting to brute force a login?
I am testing my website with hydra brute-force software. But accessing my apache conf remote server file, it seems that an attacker can't log-in more a limited number of times per seconds. Does hydra ...
- 327
9
votes
1
answer
3k
views
What local resources are used when bruteforcing a remote service?
What pc resources are used when bruteforcing ?
I mean bruteforcing something online, not hashes.
Do you need a good amount a RAM and a good CPU or it's just about the internet speed ?
- 107
9
votes
3
answers
10k
views
Which is faster - brute-forcing, or using a dictionary attack that contains all possible permutations?
Assuming a 6-character password uses the mixalphanumeric charset, giving each character a character set of 62 and the entire password a keyspace of 62^6 = 46.6 billion (if my calculations are correct)....
- 979
9
votes
4
answers
819
views
Are there state-of-the-art techniques or theory specifically for attacking passphrases over passwords?
With passphrases becoming more and more common based on length being more important than complexity, I'm assuming there must be some work going on involving techniques aimed specifically at cracking / ...
- 582
9
votes
1
answer
21k
views
Bruteforce with hashcat, how to set the mask properly?
Let's say I've an hash of this type:
test::::4e45c7bab093d7011e9b3a5df7d9fa88212beac5ac9c8c47:d6ff3373aa353f3b:123456
I would like to bruteforce it using hashcat, but I'm failing to set the correct ...
- 93
9
votes
1
answer
11k
views
How to crack 10 digits with prefix password in John the Ripper?
I want to crack a password which pattern was 10 digits start with 0910 or 0912.
So possible passwords would be e.g.
0910333444, 0910444566, 0912111222, 0912145632.
How to configure the incremental ...
- 91
9
votes
1
answer
2k
views
How to get and use constantly changing cookie JSESSIONID values in Hydra?
Related: how to get cookies from aspx site to use it with hydra
My problem is similar to the above case, I get "20 valid passwords found" but the server I'm trying to brute force sends the header set-...
- 91
8
votes
5
answers
3k
views
Increased security with keepass
I am using keepass for securing passwords. I have a reasonable password, but if someone got hold of the file I am sure eventually they could brute force it.
I was thinking of using a key file as ...
- 547
8
votes
3
answers
8k
views
Avoiding Brute Force Attacks in a Web Based Login Form
My login form uses Ajax so it doesn't need to reload if the password is wrong. A PHP script process the request and creates the session if the credentials are right. My idea is to have the PHP script ...
- 10.2k
8
votes
5
answers
2k
views
Attack vectors for brute-forcing website passwords
When talking about password security, a lot of discussion centers on the risk of a password being guessed in a brute-force attack. For websites where a user has registered an account, what are the ...
- 13.2k
8
votes
3
answers
2k
views
time to crack file-encryption password - more than just iteration
I have often seen that takes x amount of time to crack a certain length password. But this just seems to be the amount of time it takes to iterate through all the possibilities. What about the time it ...
- 81
8
votes
4
answers
2k
views
Can using emojis make someone's password safer?
I was just thinking about this the other day, after reading about making safe passwords, you have a few options:
The first would be, adding numbers, or something other than just a word
Password15068 ...
- 265
8
votes
2
answers
891
views
is it easier to get the original password if you have multiple hashes of it?
Most users tipically use the same password for multiple applications. Let's say all of these applications hash the password in some way. Would it be easier for an attacker to get the original password ...
8
votes
4
answers
9k
views
How can hackers guess passwords (using dictionary attack or brute force) without being locked out?
Nowadays almost every website you want to register in; is asking you to create a complicated password...But why cant we use simple passwords?
I am just wondering because in case of multiple wrong ...
- 81
7
votes
3
answers
2k
views
It is possible that brute force attempts are successful before the worst case, correct?
When I read about a password being secure and stating that it would take X amount of week, years, etc. isn't that referring to the worst case?
What happens if the brute force method is successul in ...
- 171
7
votes
4
answers
6k
views
Are there lists of most common words or ngrams used in passwords and passphrases?
I've been thinking about ways to focus brute forcing dictionary attacks on passwords and passphrases based on the assumption that certain words, combinations of letters, and combinations of words are ...
- 582
7
votes
2
answers
4k
views
Dictionary Attack on Wifi
I know a few people with pretty weak passwords. What kind of systems exist to prevent dictionary attacks? Would it make sense to restrict the number of connection attempts in a certain timeframe?
...
- 1,411
7
votes
2
answers
16k
views
Can DES-based hashed password be recovered if salt is known?
Can a hashed password be recovered if the hashing is done with DES based crypt function in PHP and both the hash and salt are known by the attacker?
Consider the following example:
$salt = 'mysalt';
...
- 918
7
votes
4
answers
2k
views
Is a password easier to brute force if it contains a repeating pattern?
My question is different from this previous question: Does repeating one word to form a password result in a similar pattern in its encrypted format?. I'm specifically wondering about brute force ...
- 2,267