[๖ۣۜAbяakadabяa™]

Hi fellow blackhat-ers!
Im wondering how effective bruteforcing is nowadays? Is there any more "effective" way to gain access to admin panels of websites or is bruteforcing still the best way to?
I have been abit off the forum lately so i hope to come across someone that got the experience. Thanks in advance.

[Ｅssence]

I mean 90% of sites have pretty secure passwords to their cpanels so bruteforcing is almost pointless in some cases. I had a guy try bruteforcing my cpanel login page like 2 weeks ago and he was not even close at all.

[๖ۣۜAbяakadabяa™]

I mean 90% of sites have pretty secure passwords to their cpanels so bruteforcing is almost pointless in some cases. I had a guy try bruteforcing my cpanel login page like 2 weeks ago and he was not even close at all.

Okay, just as I thought thanks for your help!

[r_r_s]

Unless a user has chosen an absolutely terrible password then BF will most likely be a waste of time. It's a very clumsy and noisy type of attack that is easily detected.

[callibrator]

Ignoring the amount of time that this attack requires, it is totally dependent on your target knowledge of computers and how secure hi wasnts to be. Personally I have worked for a guy who choose a 6 letter (only letters) password for his site... The problem is that nowdays everyone chooses to use a strong password so you should not waste in this type of attack. Except if you are using a combolix + a proxy list in order to find multiple accounts for a site, this still works pretty good

[๖ۣۜCriminal]

Unless a user has chosen an absolutely terrible password then BF will most likely be a waste of time. It's a very clumsy and noisy type of attack that is easily detected.

I mean there was a russian hacking group that brutes magento panels all day, they had the rnc's store compromised for months logging PII it's just useless on major sites, most CMS's have no username based lockout policys so you can hammer away at the admin panel for as long as you want since most only ban IP's temporarily so you can just keep rotating between IP's.RNC was the republic national convention btw.It's how most wordpress and magentos are getting taken over especially the ones that don't have any vulnerable third party plugins.It's definitely not a waste if theres groups out there daily taking down major fortune 500 companies even converse the shoe company got compromised during the BF attacks.It all depends how much effort you're putting in and if the admins are being proactive in protecting the admin directory with a .htpaswd file or what not.