+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Beginner Hacking (https://hackforums.net/forumdisplay.php?fid=4)
+---- Thread: Bruteforce attack on email adress? (/showthread.php?tid=6279920)
Bruteforce attack on email adress? - staniscraftz - Sep 17, 2024
Hey, big begginer here. So basically i'd like to get some outlook adress password by brute forcing it (i have a dictionary with all logical passwords, as they're always looking like Ab*-1234, for example, Hz*-8263 etc)
Thing is, i don't know any good tool, so i only have a ridiculous python script and obviously, microsoft blocks me pretty quickly, so even if it gets the correct password the program won't know it.
So basically, what thing would you recommend to help me do it more easily? (And please tell if the tool is on windows or linux)
(If someone wants to give it a try, tell me, i can send the stuff in pm)
RE: Bruteforce attack on email adress? - DramaKing - Sep 17, 2024
(Sep 17, 2024 09:05 AM)staniscraftz Wrote: Hey, big begginer here. So basically i'd like to get some outlook adress password by brute forcing it (i have a dictionary with all logical passwords, as they're always looking like Ab*-1234, for example, Hz*-8263 etc)
Thing is, i don't know any good tool, so i only have a ridiculous python script and obviously, microsoft blocks me pretty quickly, so even if it gets the correct password the program won't know it.
So basically, what thing would you recommend to help me do it more easily? (And please tell if the tool is on windows or linux)
(If someone wants to give it a try, tell me, i can send the stuff in pm)
Impossible. No tool can bypass the login attempts limit (ratelimit). You can try rotating proxies, but why would you need to bruteforce an email password so badly? Also, none of my passwords look like that. And it would still take you many years to bruteforce such a pattern.
RE: Bruteforce attack on email adress? - staniscraftz - Sep 17, 2024
(Sep 17, 2024 09:16 AM)DramaKing Wrote: Impossible. No tool can bypass the login attempts limit (ratelimit). You can try rotating proxies, but why would you need to bruteforce an email password so badly? Also, none of my passwords look like that. And it would still take you many years to bruteforce such a pattern.
Oh really? I though quite a lot of people were doing it that way. And for the proxies, i know that it works if i do it but i have no idea about how i can do it automatically
And i saw a tool called hydra, isn't it good for this purpose? And also, if the requests are slow enough, could it be possible to never get blocked?
And about the passwords, it's because i'm in something were all the passwords for everyone are based on the same pattern, and there's only about 3 million logical combinations, so if microsoft wasn't blocking me it'd not even take a week.
But if bruteforce isn't an option, how would you go about it?
RE: Bruteforce attack on email adress? - Sahgid - Sep 17, 2024
HOw do phishing links work?
RE: Bruteforce attack on email adress? - DramaKing - Sep 17, 2024
(Sep 17, 2024 09:21 AM)staniscraftz Wrote: Oh really? I though quite a lot of people were doing it that way. And for the proxies, i know that it works if i do it but i have no idea about how i can do it automatically
And i saw a tool called hydra, isn't it good for this purpose? And also, if the requests are slow enough, could it be possible to never get blocked?
And about the passwords, it's because i'm in something were all the passwords for everyone are based on the same pattern, and there's only about 3 million logical combinations, so if microsoft wasn't blocking me it'd not even take a week.
But if bruteforce isn't an option, how would you go about it?
Hydra will find the password for you almost immediately. It expects the HTTP response to be identical every time if incorrect and returns 'password found' if there's a change. It has no method of bypassing CAPTCHA or masking its identity as a bot.
Yeah, 3 million permutations is surprisingly small. Your targets are required to use such a predictable pattern?
How would I go about it? I wouldn't generally, but I've had success with physical access and LLMNR/NetBIOS poisoning. Could bruteforce passwords that way in a second.
Or like @DaddyZaddy@ mentioned. Certainly he wouldn't be asking his own random question on someone else's thread.
RE: Bruteforce attack on email adress? - nibblenbyte - Sep 18, 2024
(Sep 17, 2024 09:41 AM)DaddyZaddy Wrote: HOw do phishing links work?
They can be a few different things;
- Links to a fake page that the attacker has created to mimic the target website they want your credentials , normally prompting you to log in to verify an account, or many other various SE attacks.
- They can be a link that brings you to a website that has malicious code that was created by the attacker
- Can even be a straight download link that installs malware or some kind.
The options are pretty much within those realms or some variation of it.
RE: Bruteforce attack on email adress? - Sahgid - Sep 18, 2024
(Sep 18, 2024 11:54 AM)nibblenbyte Wrote: They can be a few different things;
- Links to a fake page that the attacker has created to mimic the target website they want your credentials , normally prompting you to log in to verify an account, or many other various SE attacks.
- They can be a link that brings you to a website that has malicious code that was created by the attacker
- Can even be a straight download link that installs malware or some kind.
The options are pretty much within those realms or some variation of it.
cool thanks!