New answers tagged

3

WinRAR does not check a password at all. It passes a password through the hash function to set a 128/256 Bit AES encryption key and then uses this key to encrypt the file data valid until RAR 4.x format. The new RAR 5.x format detects wrong passwords even before starting extraction and does not extract garbage. RAR 5.x stores a special password hash ...


1

You can use IP-based rate-limit, even if the attacker can control multiple IP addresses. For you, keeping track of tens of thousands of IP addresses is easy: just create a database table with IP address, account accessed, and number of authentication errors. If they are above a threshold, slow down the response. Simply sleeping for, for example, 1 second ...


1

Any hashing algorithm that is used in practice should have a key space that is impossible to brute force. On the other hand, the set of actual passwords is much more limited, so attackers will not search all possible passwords, but only those that are used by real users. Now if you have a good password, and an attacker does a brute force attack, it is not ...


2

Does it matter if a brute force search for a password returns a collision and not the password? There are other answers addressing this question quite well, so I'll explore a different angle: It doesn't matter, because brute-force searches are unlikely to ever find a collision instead of the original password. Assumptions: The password is shorter than the ...


-1

Does it matter if a brute force search for a password returns a collision and not the password? If a password is the only mechanism for accessing a resource, it often does not matter if it is exact or a collision. If you enter "dog" or "cat" and your hashing algorithm was string.length, then either will grant you access. While this is often the case, it ...


49

Steffen's answer covers this perfectly, but I just wanted to add a few more details. Anything that gives a match is usually fine As he says, you generally don't care about finding the actual password, because many applications will be happy to authenticate you with any string that happens to hash to the hash value stored in the database. This is most ...


18

The main goal of brute forcing is not to get the original password but to get a password that works. Thus it does not matter much if the found password was not the original one as long as it works. It is very likely though that with efficient and intelligent brute forcing based on a dictionary of common passwords and typical modifications the resulting ...


1

john has been supporting JWT natively as of this commit https://github.com/magnumripper/JohnTheRipper/commit/85aa7b3e3f8204360683ddc5ec9734bf793d07cf (2015). So you can just put a JWT hash in the pw file without any changes nowadays, without having to do any transformations. $ cat jwt.john eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ1c2VyIjoiYXNkZiJ9....


0

Is there a reason you're tied to patator? It looked like the --allow-ignore-failures may help but I just ran it and it didn't suppress failed attempts. I would use hydra as it's a lot simpler. This should work for you: hydra -l <user> -P <password-list-file> ssh://target (Hydra was quick answer -- hopefully I can play around with patator later ...


2

You need to correlate the failed logins on the server to some characteristic the attacker has. Typically, this can be the IP, but there may be other options depending on how your app is built and what data it collects. This means you need to keep track of failed logins across all users for some window of time. Once you identify an IP that is failing to ...


-1

Well all you can really do is slow down the Bruteforce time, making it unlikely to be achieved in a practical time, also you should implement another auth layer beyond of what you have... here is why: Your first solution has sort of a "Denial of Service" flaw because a malicious user can use known and valid 'User_ids' to block their accounts with ...


Top 50 recent answers are included