74
votes
Accepted
How does the attacker know what algorithm and salt to use in a dictionary attack?
How are plaintext and hashes compared?
During the brute force attack, words from the dictionary are hashed with the correct hash algorithm and salt, and then compared to the hash in the database dump. ...
- 65k
51
votes
Accepted
Is it possible to improve brute-force guessing of a password with a picture of the keyboard used to enter it?
In some cases yes, you can guess the most frequently used keys by the wear marks. That's how I know that apparently I use the L, M, N, A and E keys a lot - the keys are now just black, the letter is ...
- 22.6k
31
votes
Accepted
After a password leak, is there a Levenshtein distance from which one a newly derivated password can be considered safe?
Levenshtein distance as a proxy for password strength is extremely limited, for the reasons that schroeder has outlined. And the user experience will probably be poor.
But the question is still ...
- 9,308
26
votes
After a password leak, is there a Levenshtein distance from which one a newly derivated password can be considered safe?
You explicitly want to know if one can calculate a "safe" Levenshtein distance for a password. The answer is "maybe" but the answer would be irrelevant.
whether in targeted ...
- 125k
18
votes
Is it possible to improve brute-force guessing of a password with a picture of the keyboard used to enter it?
There are two different scenarios. This would be a valid question if the keyboard is used only for password typing. A numeric keypad on a door, that's something you shouldn’t post on social media. But ...
- 181
16
votes
Defense against attacks using dictionaries
This might seem like a question that has an obvious answer, but is not that trivial.
Words that do not appear in dictionaries have more randomness ('entropy') and are thus harder to guess for ...
- 1,086
10
votes
Which is faster - brute-forcing, or using a dictionary attack that contains all possible permutations?
There is no difference ... until you get into the implementations.
Efficient cracking platforms like hashcat and John the Ripper execute bruteforce directly on GPU/CPU using optimizations that make ...
- 9,308
9
votes
Wifi penetration testing: Why aireplay-ng de-authentication does not work?
I had the same problem and after some research I found that everything worked fine when I disabled the wlan0 interface before running the attack.
To disable the wlan0 interface, I used the following ...
- 91
9
votes
Wordlists on Kali Linux?
One of the better basic wordlists in Kali is /usr/share/wordlists/rockyou.txt.gz. To unzip simply run gzip -d /usr/share/wordlists/rockyou.txt.gz.
Be sure to add "known weak" passwords that are ...
- 201
8
votes
Wifi penetration testing: Why aireplay-ng de-authentication does not work?
I had a similar problem with an RTL8812AU on Kali 2018. What fixed it for me was throwing a -D into the attack command line so it stops trying to automatically determine the channel and just does what ...
- 81
7
votes
Password guessing: Is it more effective to try many passwords against a few accounts or a few (very common) passwords against many accounts?
There are huge advantages to having access to any account on a system, even if you'd like access to a specific account. I will not detail methods to hide a system wide user base password attack here, ...
- 1,431
7
votes
How does a dictionary attack use it's "words"?
A classic dictionary attack simply uses each element of the dictionary as a candidate.
Using rules to extend the dictionary is common, and tend to vary from implementation to implementation. A rule ...
- 311
7
votes
After a password leak, is there a Levenshtein distance from which one a newly derivated password can be considered safe?
From a security perspective, this metric is meaningless.
First, a password leak typically leads to a trivial attack in which the attackers will simply attack all accounts in the leak, looking for ...
- 10.2k
6
votes
Accepted
Are password-guessing attacks a real threat?
Depends what you're defending against, really.
Trying to log into a web application, attempts should indeed be restricted in some way. IP rate restriction is a good start, username level rate ...
- 27.3k
6
votes
Is it safe to use HMAC with a public key for the purpose of salting?
The username (Or user id) is not a proper salt. Salts should be unique for each combination of username+password, that means if the user changes the password the salt should change too
The salts ...
- 1,954
6
votes
dictionary attack hashing algorithm
In brute force dictionary attacks the speed of the algorithm essentially defines how many passwords can be checked within a specific time. The fewer passwords can be checked the better the algorithm ...
- 189k
5
votes
Accepted
How to generate a password dictionary for a specific use
It would be pretty easy to write a script that will generate every possible key according to those rules and dump them in a .dat file. If you want, I can whip one up for you in python and post it here,...
- 58k
5
votes
Where can I find good dictionaries for dictionary attacks?
This is one that I have found useful over the years:
https://github.com/danielmiessler/SecLists
It includes popular passwords, fuzzing based on attack type and popular user names.
- 8,165
5
votes
Accepted
I tried to break my WiFi: is 8 uppercase letter strong enough?
Personally, I don't think that 8 character (uppercase) is strong enough to withstand a determined attacker. Using only uppercase characters we have,
268 = 208827064576 possible permutations.
If we ...
- 211
5
votes
Accepted
How Aircrack reliable is for decrypting password? other alternative?
Yes, you have other alternatives. Aircrack only support dictionary and bruteforce attacks but you can convert the file into other format to be used with another tool. I can recommend to you to use ...
- 5,225
5
votes
Accepted
Creating a wordlist knowing parameters
Well, I don't see why you need to create a dictionary. You could just generate the letter combinations as the program runs. No need to generate all the combinations ahead of time.
As for generating ...
- 1,116
5
votes
Accepted
Can brute force or dictionary attacks be detected when using the WiFi protocol?
No, it is fundamentally impossible to detect a brute force or dictionary attack when using the IEEE 802.11i (WPA2) protocol. This is due to the fact that brute force attacks do not require interacting ...
- 65.5k
5
votes
dictionary attack hashing algorithm
The hashing algorithm can determine how many hashes per minute the attacker can attempt (speed).
The success rate of cracked hashes is determined by the "quality" of the dictionary and any mutation ...
- 5,745
4
votes
Accepted
What's the correct term form a pre-computed table with password/hash pairs?
If there are the entire hashes for each password it's a pre-computed hash table, in a security context it's usually called just hash tables.
If you have a strcture such as:
End of hash1 -> ...
- 1,954
4
votes
Accepted
Which is faster - brute-forcing, or using a dictionary attack that contains all possible permutations?
Any meaningful answer will have to take into account some specifics, for example which hash function was used to protect the passwords.
If you created a dictionary of all possible combinations of ...
- 9,160
4
votes
Regarding Dictionary Attack
A dictionary attack is usually carried out offline, not against an online website, for exactly the reason you raise. It requires that the password database be compromised and available for offline ...
- 72.3k
4
votes
Accepted
Password generation
You can use hashcat to do so. You can write rules that will operate on your given wordlist (in this case, the single word "PleaseSub!", however it can be as many as you please) and generate ...
- 98
4
votes
After a password leak, is there a Levenshtein distance from which one a newly derivated password can be considered safe?
Levenshtein distance is the incorrect metric here. The correct cryptographic metric for the security of a password is the size of the output keyspace (that is, the image of our procedure - the set of ...
- 391
Only top scored, non community-wiki answers of a minimum length are eligible