New answers tagged

0 votes

Do I need to set up super global SESSION for a web form?

Client-side protection isn't protection at all, it's just convenience. And a form is just a HTTP transaction, the server does not care and cannot know if what sent the transaction was your form, a ...
user avatar
  • 50.3k
0 votes

Fastest way to brute force SSH

Rockyou is very large and the sheer volume of it is such that a brute force attack is bound to take a lot of time anywway. So I would start with smaller (and obviously less complete) lists. Try the ...
user avatar
  • 6,517
0 votes

How to bypass XMLRPC lockout policy?

read this https://book.hacktricks.xyz/pentesting-web/rate-limit-bypass it contains some way that could be useful to bypass ip lockout or u could try to brute force from /wp-admin if it doesn't lock u ...
user avatar
2 votes

Fastest way to brute force SSH

It depends on the server configuration. By default some servers support between 4-10 active connections. So you cannot exceed that number. Also, it is important to consider that normally Machines from ...
user avatar
  • 1,394
0 votes
Accepted

Crack JWT HS256 with hashcat

Hashcat allows you to crack multiple formats including the one you mentioned (JWT HS256) and the strength of it relies on the secret. If the web application is using a strong secret, it can take a ...
user avatar
  • 1,394
1 vote

Crack JWT HS256 with hashcat

Can it be done in theory? Yes. You can easily format the JWT's signed parts, and signature, in the format HashCat expects, tell it the algorithm, and then set it to brute-forcing the key. Is it ...
user avatar
  • 38.9k

Top 50 recent answers are included