+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Beginner Hacking (https://hackforums.net/forumdisplay.php?fid=4)
+---- Thread: Is brute forcing my own email address illegal? (/showthread.php?tid=5211966)
Is brute forcing my own email address illegal? - Synchro - Mar 22, 2016
Hey guys im a noob hacker currently trying to learn as much as i can about hacking but i had a couple questions.
1. Is it illegal to do a brute force / dictionary attack on my own email address just to test it? This is for using email services such as yahoo / gmail etc.
2. How high are the chances of me cracking the password if i had the email address and a good word list?
Sorry if these questions are dumb lol im obviously very new and i am reading a lot of material to try and learn as much as possible. Thanks :)
* - Expels - Mar 22, 2016
couldn't you just set your pw to something secure? seems like a pointless operation.
* - tux1 - Mar 22, 2016
You don't need to lie to use this is a hack forum...
It's probably not illegal but may breach the email hosters terms. However doing it to someone else is.
It depends on how good the list is however most servers have security to prevent cracking.
* - Synchro - Mar 22, 2016
I wasn't lying i genuinely wanted to test it on myself but i wasn't sure if my account would get locked or something. Obviously i would want to do it to other people too but i just wanted to try it on myself first :P. Thanks for the help tho
* - f1re_w1re - Mar 22, 2016
(Mar 22, 2016 12:41 PM)Synchro Wrote: Hey guys im a noob hacker currently trying to learn as much as i can about hacking but i had a couple questions.
1. Is it illegal to do a brute force / dictionary attack on my own email address just to test it? This is for using email services such as yahoo / gmail etc.
2. How high are the chances of me cracking the password if i had the email address and a good word list?
Sorry if these questions are dumb lol im obviously very new and i am reading a lot of material to try and learn as much as possible. Thanks :)
1. Brutefoce and dictionary attacks are not going to get you anywhere with Yahoo or Gmail. Maybe back in the day, you could try to use a dictionary attack on the STMP server and figure out the email password, but that is all patched now.
2. The changes of you cracking a password with a dictionary attack really depends on the password; and honestly it varies. If you're trying to find the password of someone who follows decent password policies of an alphanumeric password having a symbol and upper case, you're looking at very slim changes.
* - Yotta C0d3MRY User 51 - Mar 22, 2016
There isn't a word "noob hacker".Simply you are not a hacker(maybe you are a noob).Hacker is a person who know's programming languages.
1. It is illegal to crack others account but now I don't know if it is illegal to crack your own.Maybe it is.
2. It is very hard to crack a pass with brute force method.If you want to crack an email address password and the persons password is for example "YottaC0d3MRY//\\H3ll45" it is impossible to have this password in your wordlist.
* - Nomad.Null - Mar 23, 2016
No, it isn't illegal, but it isn't really an effective or realistic attack either. Googlr may also not appreciate the spike in traffic from you and could cause your account to get locked out as a defense measure. They don't really care too much, but neither should you ask a google representative, "hey, I wanna crack my account. is that okay?"
Instead, you can simply learn about hash cracking and use your password as an experiment. In this case, you can hash your password with a weak but still common algorithm, MD5. Use a tool such as Hashcat or John the Ripper to brute force your own password to get an idea of how secure it is. A dictionary attack is quick, but if your password is very strong, will not be feasibly vulnerable to a dictionary attack unless someone has used it before and had it exposed or stolen. Remember, dictionary attacks are only effective against weak or known passwords contained in the list itself.
If you use a brute force attack on your password with reasonably accurate rules to speed up the process, you can get an idea of how secure it is. Practice with things like Hybrid attacks and permutation attacks, or even rainbow tables to see how strong your password is. You could also experiment with random words and letters.
Remember, password strength is usually defined by length over complexity. 25 lowercase letters written as random words is typically stronger than an 8 character password with full keyspace.