Questions tagged [brute-force]

In cryptography, a brute-force attack, or exhaustive key search, is a strategy that can, in theory, be used against any encrypted data.

Brute force is a naive algorithm which works through every possible answer until the correct one is found. Some problems can be reasonably solved this way.

Others, for instance obtaining the prime factors of large numbers or picking the best chess move, have a problem space far too large to be solved naively in a reasonable amount of time and effort.

A common example of brute force is password enumeration, where a large number of passwords are used against a protected resource in the hope that one is correct.

Many algorithms are born from trying to reduce the possible solutions in a problem space in an attempt to make brute force more efficient and economical.
These algorithms are generally based on heuristics generated from known patterns in the problem space.

982 questions
158
votes
16 answers

What is the best Distributed Brute Force countermeasure?

First, a little background: It is no secret that I am implementing an auth+auth system for CodeIgniter, and so far I'm winning (so to speak). But I've run into a pretty non-trivial challenge (one that most auth libraries miss entirely, but I insist…
Jens Roland
  • 27,450
  • 14
  • 82
  • 104
111
votes
10 answers

The necessity of hiding the salt for a hash

At work we have two competing theories for salts. The products I work on use something like a user name or phone number to salt the hash. Essentially something that is different for each user but is readily available to us. The other product…
kemiller2002
  • 113,795
  • 27
  • 197
  • 251
58
votes
3 answers

How long to brute force a salted SHA-512 hash? (salt provided)

Here is an algorithm in Java: public String getHash(String password, String salt) throws Exception { String input = password + salt; MessageDigest md = MessageDigest.getInstance(SHA-512); byte[] out = md.digest(input.getBytes()); …
timothyjc
  • 2,188
  • 3
  • 29
  • 54
54
votes
14 answers

Preventing Brute Force Logins on Websites

As a response to the recent Twitter hijackings and Jeff's post on Dictionary Attacks, what is the best way to secure your website against brute force login attacks? Jeff's post suggests putting in an increasing delay for each attempted login, and a…
Greg
  • 316,276
  • 54
  • 369
  • 333
44
votes
3 answers

Java all determine elements are same in a list

I am trying to determine to see if all elements in a list are same. such as: (10,10,10,10,10) --> true (10,10,20,30,30) --> false I know hashset might be helpful, but i don't know how to write in java. this is the one I've tried, but didn't…
Colin Zhong
  • 727
  • 1
  • 7
  • 16
37
votes
3 answers

What is the best method to prevent a brute force attack?

I have my login page and of course I want to prevent brute force attacks and cause less delay for the users when they are logging in. Currently, you type in your username and password to log in. I am considering implementing a reCAPTCHA. However,…
lecardo
  • 1,208
  • 4
  • 15
  • 37
32
votes
3 answers

Throttling brute force login attacks in Django

Are there generally accepted tactics for protecting Django applications against this kind of attack?
Joe Mornin
  • 8,766
  • 18
  • 57
  • 82
29
votes
10 answers

Python Brute Force algorithm

I need to generate every possible combination from a given charset to a given range. Like, charset=list(map(str,"abcdefghijklmnopqrstuvwxyz")) range=10 And the out put should be, [a,b,c,d..................,zzzzzzzzzy,zzzzzzzzzz] I know I can do…
Madushan
  • 894
  • 1
  • 10
  • 22
24
votes
4 answers

How does being able to factor large numbers determine the security of popular encryption algorithms?

How is the encryption algorithm's security dependent on factoring large numbers? For example, I've read on some math-programming forums that by using the Quadratic Sieve or the General Number Field Sieve, one can factor a 256 bit number with…
Mithrax
  • 7,603
  • 18
  • 55
  • 60
22
votes
2 answers

Delete all lines not containing string in Sublime

I recently got a bruteforce on my website, and wanted to write it down somewhere. The bad new is that the log file itself are 1,4 GB large (4338995 Lines) and I haven't got the logrotate fully working yet. So I was wondering how I could remove all…
Typewar
  • 825
  • 1
  • 13
  • 28
22
votes
2 answers

Spring Security: how to implement Brute Force Detection (BFD)?

My web applications security is handled by Spring Security 3.02 but I can't find any out of the box support for Brute Force Detection. I would like to implement some application level BFD protection. For example by storing failed login attempt per…
Kdeveloper
  • 13,679
  • 11
  • 41
  • 49
22
votes
2 answers

Why do divide and conquer algorithms often run faster than brute force?

Why do divide and conquer algorithms often run faster than brute force? For example, to find closest pair of points. I know you can show me the mathematical proof. But intuitively, why does this happen? Magic? Theoretically, is it true that "divide…
user1445654
19
votes
6 answers

Preventing Brute Force Using Node and Express JS

I'm building a website using Node and Express JS and would like to throttle invalid login attempts. Both to prevent online cracking and to reduce unnecessary database calls. What are some ways in which I can implement this?
Dave
  • 7,283
  • 12
  • 55
  • 101
18
votes
4 answers

Forgot Keystore password, thinking of Brute-Force detection. will it corrupt the keystore?

I recently realized that I have lost the password to my keystore (or perhaps the keystore got corrupted somehow) It keeps giving me the error: Keystore tampered or password incorrect I created an (quite unoptimized) algorithm to Brute-Force the…
Aman Alam
  • 11,231
  • 7
  • 46
  • 81
18
votes
9 answers

fail2ban not banning ssh bruteforce but regex works

I've just noticed an ssh bruteforce at my server, which actually should have been banned by fail2ban, but for some reason it doesn't ban it. Most people who have problems with fail2ban, seem to have problems with their regex, which seems to be fine…
fish
  • 828
  • 1
  • 6
  • 14
1
2 3
65 66