Questions tagged [brute-force]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
35 votes
2 answers
6k views

Automatically 'brute force' a few bytes to recover a corrupt file

Does anyone out there know of a way to brute force values at a particular offset in a file? It's 4 consecutive bytes which would need to be brute forced. I know the correct SHA-1 of the corrupt file. ...
Sbt19's user avatar
  • 341
6 votes
10 answers
668 views

What are the guidelines for creation of a secure passwords?

What are the best practices to create secure passwords? I would like to make them tougher to crack with brute force tools. Part II Are there any tools that can generate these passwords so I do not ...
Axxmasterr's user avatar
  • 7,918
6 votes
1 answer
36k views

How to force a connection to a site through Chrome (or any other browser's) "Your connection is not private" screen

Trying to connect to a site for work but I keep getting a "your connection is not private" screen that won't allow me to bypass it by the usual drop down and continue to site. I 1000% do not ...
Dawson's user avatar
  • 63
6 votes
1 answer
4k views

Canoga-Perkins Password recovery (Brute-forcing via COM port)

I was recently given a (Canoga-Perkins 9145E-104) Media converter/NID. The friend that gave it to me works for a local CLEC and gives me all kinds of working free gear from upgrades etc. I had ...
Tim_Stewart's user avatar
  • 5,969
6 votes
7 answers
34k views

How resistant is BitLocker against brute force attacks on the 48 character recovery key?

I've read this TechNet blog post, but I still can't determine how secure BitLocker is against a malicious user that attempts to brute force attack the recovery password. Is anyone familiar with this? ...
Mick's user avatar
  • 1,951
4 votes
3 answers
7k views

Is a Bitlocker encrypted drive safe to dispose?

Based on the nowadays public knowledge about the strongness of the Bitlocker encryption - and supposing the user thinks the Bitlocker password is strong enough to make bruteforce unviable with the ...
Áxel Costas Pena's user avatar
4 votes
1 answer
572 views

Preventing Sendmail Brute Force Attack on Solaris 10

I want to dynamically block specific connections that use the same IP address based on a rate or connection limit. Is this possible using Solaris/IPF or some sendmail extension? I want to limit ...
Andrew Case's user avatar
3 votes
1 answer
9k views

How to get thc-hydra to work from homebrew installation?

I've installed thc-hydra (brute force tool) on my OS X machine using: brew install hydra But when trying to hack the ssh password on my server I get the following error message: [ERROR] Compiled ...
norq's user avatar
  • 322
3 votes
2 answers
2k views

security of and the flaws of having open ports?

Ok, so, here is my my issue. awhile back, a friend wanted to grab some files from me, so I gave him my AFP (Apple File Protocol) address. Much like FTP SSH or SMB. Its cool for mac users and thats ...
nick's user avatar
  • 41
3 votes
1 answer
1k views

fail2ban permanent ban: resource considerations / limits?

I recently installed fail2ban on a VPS ( Ubuntu 20.04 ), with a very simple configuration to disperse ssh brute-force attackers. I am using fail2ban with ufw ( banaction = ufw ) and I decided to ban ...
darbehdar's user avatar
  • 230
3 votes
1 answer
4k views

Duplicate rule in windows firewall

Let's say you have two rules, one that block and the other that allows the connection from the exact same IP. Which rule takes precedence? Here is some context: I created a script that will block any ...
Koobecaf Eliforp's user avatar
2 votes
4 answers
3k views

brute force password guessing on SSH server isn't going to work?

I'm running an SSH server on my personal computer. The log had many people(or bots?) repeatedly trying to log in to my server (that is before I changed the default port), which made me a little ...
RamyenHead's user avatar
2 votes
2 answers
3k views

Large number of failed login attempts - cPanel Hulk Brute Force [duplicate]

Mods: Please note that this question is specifically about a server that is managed via cPanel and WHM, which makes it different than the alleged duplicate question. The past month, my personal web ...
ina's user avatar
  • 517
2 votes
1 answer
548 views

fail2ban 404 bruteforcing sharex

I use my own server (nginx, I use https://yunohost.org as a CP) as a screenshot uploader with ShareX (https://getsharex.com/). During the upload process of the screenshots the filenames are randomized....
KNIF's user avatar
  • 23
2 votes
1 answer
2k views

Compute salt with known plaintext and hash?

I have the string that was used in a webapp with md5 hashing to come up with a hash. I also have the hash. But the md5 of the string doesn't match the hash, so I'm guessing there's a salt involved. Is ...
Neil's user avatar
  • 789
2 votes
1 answer
2k views

How to increase delay of ssh root access every time login fails

Is there a way in Linux to delay, for example double the delay time, of the ssh root access every time an ssh root login fails from a given IP and them let the delay expire after X minutes of no login ...
Wulfire's user avatar
  • 21
2 votes
0 answers
4k views

Bully stuck on same pin?

BUlly is trying the same pin again and again why is that. Should i try differnet option suggest me. THE AP i'm bruteforcing has wps lock turned off i check it several times using wash. Command used ...
mhrzn's user avatar
  • 198
1 vote
3 answers
4k views

how to prevent brute force attack on ssh?

i am running centos. how can i best avoid a brute force attack on my ssh server? I found this list: DenyHosts is a Python based security tool for SSH servers. It is intended to prevent brute force ...
user avatar
1 vote
1 answer
4k views

Brute force password cracking speed - Winrar

I temporarily forgot a password for a file I had, and used a software called KRyLack RAR Password Recovery to try and recover my password. Fortunately (and unfortunately after purchasing this ...
riseagainst's user avatar
1 vote
1 answer
5k views

Password Strength Calculator

I'd like to know how much time does a password cracker would take to break my password that has setup on .rar archive. For Example- If my password has a length of 13 characters which has: 4 Letters (...
cpx's user avatar
  • 1,395
1 vote
1 answer
4k views

How can I recover my password for TrueCrypt Rescue Disk?

I just found my 10year old HDD which has been fully encrypted with TrueCrypt 7.1 (Hidden Volume) I inserted my TrueCrypt RescueDisk and had to put in my password, which I can't properly remember. I do ...
bonchance90's user avatar
1 vote
1 answer
18k views

Hydra brute force error

hydra http://192.168.0.24:1234/ http-form-post "/password=^PASS^:Invalid password!" -P pass.txt -t 10 -o hydra-http-post-attack.txt Hydra v8.1 (c) 2014 by van Hauser/THC - Please do not use in ...
Proletariat's user avatar
1 vote
1 answer
2k views

How to configure John The Ripper to use a static string as part of password discovery?

I recendly found an old microcontroller project of mine again and want to use it. Unfortunatly I forgot the password but know the middle of it. Further I get managed to free the shadow file. Is there ...
Rowolt's user avatar
  • 11
1 vote
1 answer
954 views

Block brute-force on server with http auth behind cloudflare proxies

My server is behind Cloudflare proxies. I have configured simple http authentication to restrict access to some server resources. I'm trying to block brute-force attacks on http auth with fail2ban. ...
user201622's user avatar
1 vote
1 answer
243 views

Using Medusa on Linux

I was reading about Exploitation methods when I encountered Medusa. It says that it is a brute forcing tool. But the question is that what it actually brute forces? I read somewhere the Syntex of ...
Noone Noone's user avatar
1 vote
1 answer
280 views

Creating a brute force "profile" based on past passwords

When attempting to brute force a password it can be helpful to minimize the time it needs by applying something like "mixed attacks". This question is mainly about optimizing such a mixed attack. I ...
HackXIt's user avatar
  • 309
1 vote
1 answer
723 views

linux kde full disk encryption how to bruteforce [duplicate]

how do i bruteforce a linux kde full disk encryption. i get to please unlock disk sda5 crypt. I have an apprioximate idea of the password i used. It can only be a few words but because i alphanumeric ...
mr robot's user avatar
1 vote
2 answers
5k views

Mikrotik: Ban host if there are too many HTTP requests from it

Yesterday I noticed a strange activity of my humble web server: it was moderately warm, was twitching by HDD heads and LAN activity was unusually high. When I looked to logs, found that some host is ...
Paul's user avatar
  • 914
1 vote
1 answer
19k views

Increase hydra brute force login attempts

I have recently came to know about hydra and i am playing with it using brute force. The number of login attempts are almost 10 attempts / second, I am trying with my password, so if my password ...
user avatar
1 vote
2 answers
2k views

How can I obtain a password from a website using a form using the GET method on an .aspx platform?

I am trying to find out a password for an area of a website that uses the GET method to authenticate correct credentials. The page is an .aspx but I'm not sure if that makes any effective difference. ...
CheeseConQueso's user avatar
1 vote
0 answers
138 views

Why is this successful brute force with John the Ripper unsuccessful as pw

Trying to resurrect a very old ppt file (2003 Office) So, get the hash python3 ./office2john.py ./<filename>.ppt >hash.txt After compiling the software under ubuntu (the build passed all its ...
nerak99's user avatar
  • 111
1 vote
0 answers
1k views

hashcat pkzip2 token length exeption

I have a ZipCrypto-encrypted archive and I lost the password. I'm trying to crack it using zip2john and hashcat but I got this error. Is there any way to fix it? Hashfile './test2.txt' on line 1 ($...
Ilham Yassin's user avatar
1 vote
0 answers
718 views

Does Windows 10 have brute force protection against an attack from its local network?

Say, we have two machines on a local network: Machine A is malicious and is trying to access userdata on Machine B. Machine B runs Windows 10 Pro with "Network discovery" turned on. The ...
Leo's user avatar
  • 169
1 vote
1 answer
1k views

How to make hydra brute force in one seclists file

I am trying to crack a ftp server with brute force. However, in seclists there are ftp file but its format is like: root:password I can brute force with multiple text files with command sudo hydra -t ...
Bati's user avatar
  • 11
1 vote
1 answer
382 views

Is it possible to configure Windows 10 to shut down or re-start after too many failed login attempts?

My laptop's C-drive is encrypted with VeraCrypt and a very strong password. But, my Windows Hello password is quite weak. If an attacker gets my laptop while it is running but Windows is locked, or ...
Usal's user avatar
  • 21
1 vote
1 answer
3k views

Dictionary attack in Bash with cURL

I'm fairly new to Bash, but this is a script I've been working on for the past few days. It's meant to run a dictionary attack on an HTTP-POST login for a website, by reading the time module and ...
Aqueous Computing's user avatar
1 vote
2 answers
505 views

Do consumer routers implement safeguards against login brute force attacks?

I'm not talking about trying to crack the encryption key, but if malware got onto your computer, and attempted to brute force your router's login password. I know that the majority of people are using ...
0_______0's user avatar
  • 136
1 vote
2 answers
6k views

How to find password on a router (cabled) without a hard reset? brute-force only option?

So I've seen a few post like that on here but none seem to work in my case short of brute-forcing but I've never done it before so I want to be sure of what I'm doing first. Alright here is the deal, ...
Gaetan's user avatar
  • 11
0 votes
3 answers
10k views

How to brute force attack a phone [closed]

I have an old cell phone that I forgot the password to. You can have unlimited tries to unlock the phone. It has the basic 0-9 input system with 4 characters unlocking the phone. I was wondering if ...
Chase Ernst's user avatar
0 votes
2 answers
817 views

Need program to brute force [closed]

we have written an application which involves user and id parameters. We would like to test the app with brute force attack, where login is known, and password is max 6 characters. Is there any "...
integratorIT's user avatar
0 votes
1 answer
3k views

How to crack my MacBook’s password?

I forgot my laptop password. I tried a lot of passwords but my laptop does not accept it. I searched the internet for possible answers, and I've come across the "Brute-Force or Dictionary force&...
dtc348's user avatar
  • 127
0 votes
2 answers
3k views

How can I estimate the time it takes a certain computer to guess a password?

As cyber security and its exploitation become more prominent and relevant, I find websites such as https://howsecureismypassword.net/ to be very interesting. When the user enters a password, it ...
657784512's user avatar
  • 113
0 votes
1 answer
15k views

Unsure if I have understood Hydra syntax correctly?

So, when I see the Hydra help file, this is what it says: Syntax: hydra [[[-l LOGIN|-L FILE] [-p PASS|-P FILE]] | [-C FILE]] [-e nsr] [-o FILE] [-t TASKS] [-M FILE [-T TASKS]] [-w TIME] [-W TIME] [-f]...
user1720897's user avatar
0 votes
3 answers
18k views

Cracking WPA2 using Intel HD Graphics GPU

I use Linux Kali and yesterday have captured a WPA handshake of my network. I want to crack it's password - but my CPU with aircrack-ng checks only about 2000 keys per second. In my laptop I have got ...
TN888's user avatar
  • 103
0 votes
1 answer
71 views

Can someone help me unlock my MacBook?

can someone tell me how I brute force my MacBook air with mac os x snow leopard? I have tried everything I can possibly think of! I have an PC, can i use it? Thanks!
Jack's user avatar
  • 1
0 votes
1 answer
384 views

Is it possibly to queue dictionaries or lists in hashcat?

I'm trying to brute force one of my old harddrives I no longer have the password for; (LUKS v1). Hashcat is doing great for this, I'm just not sure how to queue multiple lists or dictionaries other ...
Nareik Seivad's user avatar
0 votes
1 answer
266 views

Restrictions when using diskutil coreStorage unlockVolume

I wrote a very simple brute force script on my Mac that runs the $ diskutil coreStorage unlockVolume <UUID> -passphrase <PASSWORD> command against a HFS+ encrypted drive by going through a ...
Evan Wieland's user avatar
0 votes
2 answers
7k views

Brute force URL with number range

For example: http://example.com/xxxx.php I know that xxxx is a number between 1-9000. How to brute force the range?
user avatar
0 votes
1 answer
231 views

How to Optimize a Dictionary / Word List?

I have a copy of a 4.09 GB wordlist / dictionary crackstation.txt. Just now the words and numbers are arranged in the usual order: 0123456789aAbBcCdDeEfFgGhHiIjJkKlLmMnNoOpPqQrRsStT uUvVwWxXyYzZ ...
OKCarl's user avatar
  • 1
0 votes
1 answer
2k views

Entering Password in su- through loop

The Scenario is like I have a list of root passwords. But i don't want to keep trying Manually. So i wrote the shell script : for i in {1..26} do su - >>result done and all my password are on ...
Dhruv Chandhok's user avatar