+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Beginner Hacking (https://hackforums.net/forumdisplay.php?fid=4)
+---- Thread: is brute force really outdated? (/showthread.php?tid=5697039)
Pages: Pages
1
2
is brute force really outdated? - v740612 - Aug 17, 2017
is there any possibly way for it to work? I'm just trying to find my old email, not hack anybody. Yahoo and gmail are absolute SHIT and don't provide any customer service. I have been struggling for 6 years trying to find my old email accounts.
Can you use burp suite pro + hydra for brute forcing to really work? I saw this in a youtube video and it was legit.
Plus, adding a wait time between attempts to avoid captcha/lock out. Or if fails, use an auto captcha solver. Has anyone tried this to see if it works?
The reason i'm asking is cause i'm still waiting for my free trial of burp suite pro to be sent to my email. It has pretty much everything you need to hack like a professional...I can't wait to try it.
Hydra alone sucks. I tried using it on an email that I already know, created a word list with the password in it, and it said all the passwords are invalid, WTF?!?
* - bananasouce - Aug 17, 2017
I can tell you already that this is not going to work..
With brute forcing you are trying to find a hay in a needle factory.
* - Vana - Aug 17, 2017
With connection times, account locking, and captchas, you're not going to get anywhere attempting this.
* - Elitas - Aug 17, 2017
Brute forcing has been out of date since people started using stronger passwords.
Dictionary attacks (ie educated wordlists) are still useful and extremely relevant in many fields of hacking such as hash cracking or even targeted attacks on websites.
* - v740612 - Aug 17, 2017
(Aug 17, 2017 03:23 PM)bananasouce Wrote: I can tell you already that this is not going to work..
With brute forcing you are trying to find a hay in a needle factory.
Pretty sure it's the other way around...
A needle in haystack
🤦♂
* - Elitas - Aug 17, 2017
(Aug 17, 2017 03:24 PM)Vana Wrote: With connection times, account locking, and captchas, you're not going to get anywhere attempting this.
You're forgetting that there are many ways to get the header response from a website to verify whether you have the correct username/password.
Take APIs for example, they sometimes require authentication in order to gather specific API information. These can be manipulated in the form of a GET request which can respond with either a successful authentication or an invalid authentication.
Sometimes this doesn't even require proxies.
(Aug 17, 2017 03:17 PM)v740612 Wrote: is there any possibly way for it to work? I'm just trying to find my old email, not hack anybody. Yahoo and gmail are absolute SHIT and don't provide any customer service. I have been struggling for 6 years trying to find my old email accounts.
Can you use burp suite pro + hydra for brute forcing to really work? I saw this in a youtube video and it was legit.
Plus, adding a wait time between attempts to avoid captcha/lock out. Or if fails, use an auto captcha solver. Has anyone tried this to see if it works?
The reason i'm asking is cause i'm still waiting for my free trial of burp suite pro to be sent to my email. It has pretty much everything you need to hack like a professional...I can't wait to try it.
Hydra alone sucks. I tried using it on an email that I already know, created a word list with the password in it, and it said all the passwords are invalid, WTF?!?
I mean Hydra is a little outdated and I haven't used it successfully in years. There are new tools out now which works. I've been looking at ways of preventing them. It's all about websites being tight on the information which they serve to users be it from an API or a response to a specific POST request. API keys and captchas are good ways of limiting brute force attempts but they aren't perfect.
* - bananasouce - Aug 17, 2017
(Aug 17, 2017 03:26 PM)v740612 Wrote: Pretty sure it's the other way around...
A needle in haystack
🤦♂
No, cuz it is way harder that just that.
* - Vana - Aug 17, 2017
(Aug 17, 2017 03:27 PM)Elitas Wrote: You're forgetting that there are many ways to get the header response from a website to verify whether you have the correct username/password.
Take APIs for example, they sometimes require authentication in order to gather specific API information. These can be manipulated in the form of a GET request which can respond with either a successful authentication or an invalid authentication.
Sometimes this doesn't even require proxies.
Most APIs don't take username:password authentication, usually OAuth or API keys. Along with that, rate limiting will more than likely impede on how many API requests you can make.
* - v740612 - Aug 17, 2017
(Aug 17, 2017 03:27 PM)Elitas Wrote: I mean Hydra is a little outdated and I haven't used it successfully in years. There are new tools out now which works. I've been looking at ways of preventing them. It's all about websites being tight on the information which they serve to users be it from an API or a response to a specific POST request. API keys and captchas are good ways of limiting brute force attempts but they aren't perfect.
You mean better alternatives, like Medusa or nCrack, plus using botnets?
* - Nomad.Null - Aug 17, 2017
It's possible if you have a pretty good idea what password might be being used by a list of accounts, but spraying a single account with thousands of passwords is not feasible anymore over HTTP/HTTPS requests unless literally no security has been built into the system. There is no way to get around account lockout thresholds and rate limits. If you have been trying to get back this account for 6 years, shouldn't you have moved on by now anyway?
Long time ago, bro. Cut the cord.
* - ๖ۣۜCriminal - Aug 17, 2017
Expanding on what Vana said in the future all websites will enable username based lockout policies by default very few currently do this due to user experience hindering, most sites use IP based lockout systems which are trivial to bypass with optic fiber socks5 which supersede tradional proxies because you get really nice speed out(better HTTP r/s) of it compared to public proxy lists. But once this happens bruteforcing and dictionary attacks will completely die out however in this day and age barely anyone does this, most people do whats known as a credential stuffing attack where they SQL inject another site crack the hashes and then run the leaked credentials on various other sites checking for password reuse so we can say it's pretty much already dead since so few people actually crack most people just check credentials hacked from other sites and sell the accounts obtained.
* - Mr.Zzz - Aug 17, 2017
According to me Hydra is not so inefficient (I found several passwords with it) mostly combined with Crunch. The main point is that several providers have implemented cracking protection system (i.e. gmail and Yahoo).
Cheers!
* - ๖ۣۜCriminal - Aug 17, 2017
(Aug 17, 2017 07:17 PM)Mr.Zzz Wrote: According to me Hydra is not so inefficient (I found several passwords with it) mostly combined with Crunch. The main point is that several providers have implemented cracking protection system (i.e. gmail and Yahoo).
Cheers!
you must be bruteforcing some random chinese wordpress blog running wordpress 2 which is years old for hydra to still work in 2017, because all sites have some sort of rate limiting in place and hydras not designed for bypassing rate limits, it doesn't even support proxies it only supports one proxy and thats pretty much useless.
* - G3yb01 - Aug 17, 2017
AI Bruteforcing.
ITs more alive than ever.
* - v740612 - Aug 17, 2017
(Aug 17, 2017 07:19 PM)๖ۣۜCriminal Wrote: you must be bruteforcing some random chinese wordpress blog running wordpress 2 which is years old for hydra to still work in 2017, because all sites have some sort of rate limiting in place and hydras not designed for bypassing rate limits, it doesn't even support proxies it only supports one proxy and thats pretty much useless.
Did you not read my post? Hydra is designed to avoid rate limits, using -w / -W to indicate wait time for responses. Of course, that would make the process much more slower.
It's impossible to bypass rate limits unless you hack the server.
and why would you need to use more than one proxy?