All Questions
38 questions
-1
votes
1
answer
395
views
bruteforce local software's password
There is a lot of online tools to bruteforce online server like hydra and offline with hashes like hashcat. Yet it seems very weird that there is not a single offline bruteforcing app for software. ...
0
votes
1
answer
192
views
FFUF command returns status code 400, regardless of mode option: clusterbomb, pitchfork, sniper
I'm working on a lab on PortSwigger.com titled Username enumeration via different responses. While using ffuf to solve the lab, the output keeps returning a 400 status code.
So far this is what I've ...
user303027
0
votes
0
answers
104
views
Which password is more secure? [duplicate]
Which password is harder to guess/brute-force:
onlysmallletters!
Ez65);k
And also, can you explain your answer?
- 101
0
votes
1
answer
133
views
If a platform/system has brute force protection should I care for a very strong password
If a platform has brute force protection should I worry about creating a very strong password since any attacker would not get a chance to reach enough attempts to crack even the weakest password?
Not ...
- 103
0
votes
2
answers
1k
views
How does having a password hash speed up cracking vs not having a hash (on-site)?
On Windows, user password hashes are not salted and, on Linux, user password hashes are stored in the same root-owned file as the salt. Given this, in what ways might a bruteforce attack to find the ...
- 331
1
vote
0
answers
564
views
Hardware for password cracking
I'm planning to extend my pentest services to Password Cracking, to be more precise: Cracking Active Directory Passwords, extracted from the customers Active Directory in order to check users ...
- 129
0
votes
0
answers
151
views
Isn't this kind of password ultimately secure and insanely easy to remember? [duplicate]
Pick any dictionary word.
Think of a number over 10 and below 20.
Repeat the word as many times as the number, and end off with the same number (for example, "12").
Example:
...
- 1
2
votes
1
answer
949
views
Is better to have as password a sentence or first letter of the sentence?
Which is better master KeePass password to prevent any type of bruteforce between theses two type of password :
Complete sentence invented by user like : I like cheeseburger,
tomatoes and fries ! :)
...
- 274
9
votes
1
answer
3k
views
What local resources are used when bruteforcing a remote service?
What pc resources are used when bruteforcing ?
I mean bruteforcing something online, not hashes.
Do you need a good amount a RAM and a good CPU or it's just about the internet speed ?
- 107
3
votes
2
answers
746
views
Is using a phrase from a book as a password such a bad idea
I've been told/seen online that choosing a sentence or a phrase from a book and using it as a password is a bad idea. How is this true? Unless the potential attacker knew which book you used I don't ...
- 31
1
vote
2
answers
10k
views
Brute-Forcing DVWA login page with hydra
I'm learning how to brute force web login pages with a popular brute force tool called "Hydra". I'm using Kali Linux (VirtualBox) to do this. I've installed DVWA (Damn Vulnerable Web Application) and ...
- 11
2
votes
2
answers
2k
views
Are partial passwords a security improvement over full passwords?
With full password authentication, you need to enter the full password every time.
With partial password authentication, you're asked for some subset of the password each time, and which characters ...
- 373
2
votes
1
answer
2k
views
hashcat specific brute force
Is this scenario possible:
I know the first three letters of the password (exact), i know the password is between 10-14 characters, i know the rest of the characters are "b,t,p,1,3,6,7" which can be ...
- 219
0
votes
1
answer
4k
views
How can hackers get 1 billion passwords per second?
So I'm interested in Brute Force attacks and I have made them with Python 3 and C++. However, those only reached a max of about 20 million passwords per second.
I know for a fact that 1 billion ...
- 11
1
vote
0
answers
1k
views
Kerberos and brute-force attacks
Suppose that I am the administrator of a system that uses Kerberos and password authentication. How can I make brute-force attacks on user’s passwords by an attacker who can capture network traffic ...
- 889
3
votes
1
answer
877
views
Are there bruteforce programs that use letters of other languages? Arabic? Greek?
I came across a site that had the password strength meter. I tried using 'password' and the meter did not like my password. Then I happened to try 'password' but I used the arabic translation for 'a' ...
- 45
5
votes
2
answers
4k
views
How to brute-force a somewhat remembered aescrypt password?
I have a file I encrypted with AES via aescrypt about 5 years ago. I remember a lot of things about the password with several prefixes and suffixes. I have experience as a programmer but not with ...
- 155
9
votes
1
answer
21k
views
Bruteforce with hashcat, how to set the mask properly?
Let's say I've an hash of this type:
test::::4e45c7bab093d7011e9b3a5df7d9fa88212beac5ac9c8c47:d6ff3373aa353f3b:123456
I would like to bruteforce it using hashcat, but I'm failing to set the correct ...
- 93
9
votes
3
answers
10k
views
Which is faster - brute-forcing, or using a dictionary attack that contains all possible permutations?
Assuming a 6-character password uses the mixalphanumeric charset, giving each character a character set of 62 and the entire password a keyspace of 62^6 = 46.6 billion (if my calculations are correct)....
- 979
4
votes
2
answers
1k
views
What's the correct term form a pre-computed table with password/hash pairs?
The table looks like this:
123456 -> asfty18u78t489yh
password -> 89y203rupdifhof
something -> 2r892389n89rfsd
And the idea is that if you have the hash (asfty18u78t489yh), you know ...
- 277
3
votes
1
answer
961
views
Is logging into SSH with a 2048 bit SSH password less secure than logging in with a a 2048 bit private key? [duplicate]
I'm certainly not saying this is a "good idea," and I always disable password authentication on SSH servers. However, the question came up when talking to a friend: If your password is as long and ...
- 515
0
votes
2
answers
4k
views
How customising a wordlist to make a bruteforce attack in leetspeak with hashcat or John the ripper
I'm trying to unlocking my encrypted external harddisk because I have lost my paper with the password. With the help of user3439894 I have a short program to injecting a wordlist and unlocking the ...
- 1
4
votes
5
answers
2k
views
What makes one random strong password more resistant to a brute force search than another
The only way to do this is by making an educated guess on how the brute force algorithm works or probably works.
Lets say you were trying to crack a combination lock with 3 discs each with 10 ...
- 149
2
votes
4
answers
3k
views
How to figure about the total amount of password combinations possibles that have salt values?
I'm reading this book about Computer Security to better prepare me for my role, however, this question is just not clicking to me. I've figured out half of it, but cannot figure out this last part. If ...
- 21
0
votes
2
answers
8k
views
Calculating permutations of a hexadecimal character set [closed]
How long would it take to run through all permutations/combinations of a ten character set; assuming the character-set is limited to a hexadecimal alphabet? (i.e. 16 characters {0..9}{A..F}; eg. ...
- 1,809
5
votes
1
answer
642
views
Spoofing an NTP server to allow bruteforce on any smartphone
We all know that smartphones (i'll take iPhone as an example) rely on SNTP/NTP servers to update a device's time and date. So, by creating an SNTP server that mimics Apple's server, we can actually ...
- 211
3
votes
2
answers
448
views
What scenario are 'extra' strong passwords and hashing algorithms actually protecting against?
Note: I completely understand the need for strong passwords & I understand that there is an issue of speed with hashing. I am just interested in better understanding the actual negative impact of ...
- 133
8
votes
4
answers
2k
views
Can using emojis make someone's password safer?
I was just thinking about this the other day, after reading about making safe passwords, you have a few options:
The first would be, adding numbers, or something other than just a word
Password15068 ...
- 265
0
votes
1
answer
580
views
Ignoring collision and (second) pre-image resistance, what makes a cryptographic hash function strong?
With regards to resistance against dictionary and brute-force attacks to "crack" hashes containing passwords, what determines the resistance of a cryptographic hash function? Since collision ...
- 101
21
votes
5
answers
8k
views
Would allowing shorter passwords sometimes be more secure?
Does the act of requiring certain criteria for passwords make them easier to brute-force?
It's always seemed to me that when websites limit the use of "insecure" passwords, it might make it easier ...
- 313
4
votes
1
answer
17k
views
how to get cookies from aspx site to use it with hydra
I've been playing around with Hydra and .aspx site and I've hit a bit of a snag - Hydra responds letting me know that the first 16 passwords in my password list are correct when none of them are.
...
- 43
6
votes
3
answers
33k
views
Brute force alphanumeric password using JohnTheRipper
I recently recovered a zip archive with some files I need access to, but I can't remember the password. All I can remember is that the password was short (around 3-4 characters), and contained only ...
- 171
3
votes
1
answer
2k
views
Cracking a 6-character alphanumeric password Windows dialog box
To put this problem in context, I have a touch monitor screen whose firmware program is protected by a password.
The firmware program is downloaded over RS232 via a Windows utility program provided ...
- 131
3
votes
1
answer
20k
views
How long it will take to crack a RAR password?
I wonder how long it will take to crack 16 character alphanumeric WinRAR password for a mini supercomputer. As far as I know graphic cards are preferred over CPUs to crack passwords nowadays. If we ...
- 415
36
votes
2
answers
44k
views
Why are GPUs so good at cracking passwords?
What is it about GPUs that lets them crack passwords so quickly?
It seems like the driving force behind adopting good key-derivation functions for passwords (bcrpyt, PBKDF2, scrypt) instead of ...
- 465
3
votes
1
answer
3k
views
Pointers for john the ripper rulesets
I've been pouring over the JtR ruleset documentation and making little progress. I understand how to use it to make various permutations from a given wordlist, that's fine. However, I'm trying to ...
- 133
1
vote
2
answers
2k
views
Password Protected Zip: if attacker had one file, can use it to decrypt all files?
Consider a folder containing the following files:
(file1.txt, file2.doc, file3.pdf) all zipped and password protected, if attacker had one of these file, can use it for decrypting all without knowing ...
- 1,377
14
votes
3
answers
21k
views
Cracking MS-CACHE v2 hashes using GPU
As most people here will know, Windows caches domain/AD credentials in a format known as MS-Cache v2. Obviously, these would be excellent passwords to gain during a penetration test when local access ...
- 11.5k