74 votes
Accepted

How does the attacker know what algorithm and salt to use in a dictionary attack?

How are plaintext and hashes compared? During the brute force attack, words from the dictionary are hashed with the correct hash algorithm and salt, and then compared to the hash in the database dump. ...
  • 65k
51 votes
Accepted

Is it possible to improve brute-force guessing of a password with a picture of the keyboard used to enter it?

In some cases yes, you can guess the most frequently used keys by the wear marks. That's how I know that apparently I use the L, M, N, A and E keys a lot - the keys are now just black, the letter is ...
  • 22.6k
31 votes
Accepted

After a password leak, is there a Levenshtein distance from which one a newly derivated password can be considered safe?

Levenshtein distance as a proxy for password strength is extremely limited, for the reasons that schroeder has outlined. And the user experience will probably be poor. But the question is still ...
26 votes

After a password leak, is there a Levenshtein distance from which one a newly derivated password can be considered safe?

You explicitly want to know if one can calculate a "safe" Levenshtein distance for a password. The answer is "maybe" but the answer would be irrelevant. whether in targeted ...
  • 125k
18 votes

Is it possible to improve brute-force guessing of a password with a picture of the keyboard used to enter it?

There are two different scenarios. This would be a valid question if the keyboard is used only for password typing. A numeric keypad on a door, that's something you shouldn’t post on social media. But ...
  • 181
16 votes

Defense against attacks using dictionaries

This might seem like a question that has an obvious answer, but is not that trivial. Words that do not appear in dictionaries have more randomness ('entropy') and are thus harder to guess for ...
  • 1,086
10 votes

Which is faster - brute-forcing, or using a dictionary attack that contains all possible permutations?

There is no difference ... until you get into the implementations. Efficient cracking platforms like hashcat and John the Ripper execute bruteforce directly on GPU/CPU using optimizations that make ...
9 votes

Wifi penetration testing: Why aireplay-ng de-authentication does not work?

I had the same problem and after some research I found that everything worked fine when I disabled the wlan0 interface before running the attack. To disable the wlan0 interface, I used the following ...
9 votes

Wordlists on Kali Linux?

One of the better basic wordlists in Kali is /usr/share/wordlists/rockyou.txt.gz. To unzip simply run gzip -d /usr/share/wordlists/rockyou.txt.gz. Be sure to add "known weak" passwords that are ...
  • 201
8 votes

Wifi penetration testing: Why aireplay-ng de-authentication does not work?

I had a similar problem with an RTL8812AU on Kali 2018. What fixed it for me was throwing a -D into the attack command line so it stops trying to automatically determine the channel and just does what ...
7 votes

Password guessing: Is it more effective to try many passwords against a few accounts or a few (very common) passwords against many accounts?

There are huge advantages to having access to any account on a system, even if you'd like access to a specific account. I will not detail methods to hide a system wide user base password attack here, ...
7 votes

How does a dictionary attack use it's "words"?

A classic dictionary attack simply uses each element of the dictionary as a candidate. Using rules to extend the dictionary is common, and tend to vary from implementation to implementation. A rule ...
  • 311
7 votes

After a password leak, is there a Levenshtein distance from which one a newly derivated password can be considered safe?

From a security perspective, this metric is meaningless. First, a password leak typically leads to a trivial attack in which the attackers will simply attack all accounts in the leak, looking for ...
  • 10.2k
6 votes
Accepted

Are password-guessing attacks a real threat?

Depends what you're defending against, really. Trying to log into a web application, attempts should indeed be restricted in some way. IP rate restriction is a good start, username level rate ...
  • 27.3k
6 votes

Is it safe to use HMAC with a public key for the purpose of salting?

The username (Or user id) is not a proper salt. Salts should be unique for each combination of username+password, that means if the user changes the password the salt should change too The salts ...
  • 1,954
6 votes

dictionary attack hashing algorithm

In brute force dictionary attacks the speed of the algorithm essentially defines how many passwords can be checked within a specific time. The fewer passwords can be checked the better the algorithm ...
5 votes
Accepted

How to generate a password dictionary for a specific use

It would be pretty easy to write a script that will generate every possible key according to those rules and dump them in a .dat file. If you want, I can whip one up for you in python and post it here,...
5 votes

Where can I find good dictionaries for dictionary attacks?

This is one that I have found useful over the years: https://github.com/danielmiessler/SecLists It includes popular passwords, fuzzing based on attack type and popular user names.
  • 8,165
5 votes
Accepted

I tried to break my WiFi: is 8 uppercase letter strong enough?

Personally, I don't think that 8 character (uppercase) is strong enough to withstand a determined attacker. Using only uppercase characters we have, 268 = 208827064576 possible permutations. If we ...
  • 211
5 votes
Accepted

How Aircrack reliable is for decrypting password? other alternative?

Yes, you have other alternatives. Aircrack only support dictionary and bruteforce attacks but you can convert the file into other format to be used with another tool. I can recommend to you to use ...
5 votes
Accepted

Creating a wordlist knowing parameters

Well, I don't see why you need to create a dictionary. You could just generate the letter combinations as the program runs. No need to generate all the combinations ahead of time. As for generating ...
  • 1,116
5 votes
Accepted

Can brute force or dictionary attacks be detected when using the WiFi protocol?

No, it is fundamentally impossible to detect a brute force or dictionary attack when using the IEEE 802.11i (WPA2) protocol. This is due to the fact that brute force attacks do not require interacting ...
  • 65.5k
5 votes

dictionary attack hashing algorithm

The hashing algorithm can determine how many hashes per minute the attacker can attempt (speed). The success rate of cracked hashes is determined by the "quality" of the dictionary and any mutation ...
  • 5,745
4 votes
Accepted

What's the correct term form a pre-computed table with password/hash pairs?

If there are the entire hashes for each password it's a pre-computed hash table, in a security context it's usually called just hash tables. If you have a strcture such as: End of hash1 -> ...
  • 1,954
4 votes
Accepted

Which is faster - brute-forcing, or using a dictionary attack that contains all possible permutations?

Any meaningful answer will have to take into account some specifics, for example which hash function was used to protect the passwords. If you created a dictionary of all possible combinations of ...
  • 9,160
4 votes

Regarding Dictionary Attack

A dictionary attack is usually carried out offline, not against an online website, for exactly the reason you raise. It requires that the password database be compromised and available for offline ...
  • 72.3k
4 votes
Accepted

Password generation

You can use hashcat to do so. You can write rules that will operate on your given wordlist (in this case, the single word "PleaseSub!", however it can be as many as you please) and generate ...
  • 98
4 votes

After a password leak, is there a Levenshtein distance from which one a newly derivated password can be considered safe?

Levenshtein distance is the incorrect metric here. The correct cryptographic metric for the security of a password is the size of the output keyspace (that is, the image of our procedure - the set of ...
  • 391

Only top scored, non community-wiki answers of a minimum length are eligible