PDF User Password always give access to the Owner Password, even when encrypted with AES-128

I’ve been messing around with qpdf, and noticed something that seems huge: that a document’s Owner Password is essentially useless, as it can be easily unset, and therefore that only the User Password offers any real security for a PDF.

F… Continue reading PDF User Password always give access to the Owner Password, even when encrypted with AES-128

Both Ophcrack and ONTP&RE incorrectly show Windows 10 passwords as blank

I’m trying to crack a Windows 10 laptop that I myself set a password on a day or so ago. So far I’ve tried booting into Ophcrack 3.6 and ONTP&RE (Offline NT Password & Registry Editor) from LiveUSBs – both report the password as be… Continue reading Both Ophcrack and ONTP&RE incorrectly show Windows 10 passwords as blank

Is it still possible to run an online dictionary attack from a single machine, without anonymisation?

This question concerns dictionary attacks conducted:

Over the Internet, using programs like THC Hydra
Via protocols such as HTTP, FTP and SMTP

I believe I’m right in thinking that: a) due to the sophisticated layers of security they te… Continue reading Is it still possible to run an online dictionary attack from a single machine, without anonymisation?

Which is faster – brute-forcing, or using a dictionary attack that contains all possible permutations?

Assuming a 6-character password uses the mixalphanumeric charset, giving each character a character set of 62 and the entire password a keyspace of 62^6 = 46.6 billion (if my calculations are correct), would it be faster to b… Continue reading Which is faster – brute-forcing, or using a dictionary attack that contains all possible permutations?

Which is faster – brute-forcing, or using a dictionary attack that contains all possible permutations?

Assuming a 6-character password uses the mixalphanumeric charset, giving each character a character set of 62 and the entire password a keyspace of 62^6 = 46.6 billion (if my calculations are correct)…

Would it be faster t… Continue reading Which is faster – brute-forcing, or using a dictionary attack that contains all possible permutations?