Collaborate Disseminate
I am working on the following war game from Defend The Web, which requires me to do a source code review to login as the user memtash. The code is on GitLab here.
Having inspected the source code during this code review, I find this line i… Continue reading How long would this take to bruteforce?
I’m testing brute force with hydra but my failed message contains ":" and it is giving me an error:
attacking http-post-form://testfire.net:80/login.jsp:uid=^USER^&passw=^PASS^&btnSubmit=submit:F= Login Failed: We’re sorr… Continue reading problem with hydra failed message [duplicate]
I was wondering if there is a formula to calculate how long it would take to "guess" a "X-Digit" OTP, presuming you limited the number of times you can try for each code and the number of codes you can get over a period… Continue reading What is the formula to estimate how long it can take to guess an OTP? [migrated]
Determine the size of the key required (in bits) in order to ensure that on average it will take longer than 10 years to successfully perform a brute-force decryption of a file, assuming that one key can be tested in 107 seconds and that 1… Continue reading How to compute key size for given resistance? [closed]
I have come across scenarios where a website would send OTP once a user has supplied valid username/password. A confirmation dialog e.g. An OTP has been sent to your registered mobile number would be displayed to the user. When a user has … Continue reading Does this implementation of 2FA expose valid credentials?
How can I automate a bruteforce attack login forms? When I entered /admin, I am prompted with this. I usually use burp’s intruder and hydra, but what should I do to attack these two input fields?
Continue reading Is it possible to bruteforce a browser prompt? [closed]
Today this came to my attention.
When generating random secrets for e.g. JWT (in node.js the most common way is using the crypto.randomBytes() method), I have noticed a lot of people save these tokens in a base64-encoded manner (i.e. crypt… Continue reading Randomly generated secrets: encoding the random bytes in base64 vs keeping them
I’m learning how to use hydra, but I found a problem.
When I run the following script, I get a CSRF token error. Apparently, the problem is that the token received in CURL is different from the one in hydra.
Step by step:
I have created th… Continue reading Brute-Forcing DVWA login page with hydra – csrf incorrect
I’ve been playing with a CUDA MD5 cracker which is very impressive indeed.
For a novelty project, I’d like to make a file that contains the last 32 bits of it’s own hash.
I’d like to achieve this by starting the MD5 in an initial state tha… Continue reading Brute force (last 32 bits of) MD5 with salt [closed]
was trying to brute force a random number generated by the ruby method rand which generated a random float number between 0.0 and 1.0 excluding 1.0.
so for example I have this code:
Time.now.to_s.split(//).sort_by {rand}.join
this produce… Continue reading brute forcing a pseudoRandom number Generator