Bruteforce is confusing!

[Mora Hannover]

I have seen many bruteforce topics!
like this one : http://www.cplusplus.com/forum/lounge/151573/

So lets say for example I made a program that requires a password to be used and I want to bruteforce that password!
In the topic above I have seen a bruteforce code! and the guy said
"I tried setting the password as "megatron" it ran for 18 minutes before I got bored. So I went for a simple test."
and then in the program output

Attempting to crack...

Correct password! - pound

real	0m4.857s
user	0m7.316s
sys	0m0.056s

EDIT - Test 2 - 6 letters

Attempting to crack...

Correct password! - dollar

real	0m39.247s
user	0m57.548s
sys	0m0.520s

So what's mindblowing that in the whole code there is nothing to set a password!!
So how did he set one?
I tried running the code in CodeBlocks but I got a crazy console and that is
generating weird things!

I am sorry if I did a mistake. I am not a c++ pro like you all!

[Peter87]

He probably hard-coded the password in Target.cpp.

const std::string password = "pound";

[shadder]

Hi,

Try to output the permutations in a file instead of console and see if the result is still crazy..

[Duthomhas]

"Brute force" is a generalized term that means trying every possible combination of data that might solve a problem.

In the case of solving a password, it is trying every possible password against the credential server -- from every 1 character password to every N character password -- try each next possible password until the correct one is found.

Doing it this way you will eventually come across the correct password.


The problem is that it is exceedingly inefficient, and attempts to do it will be noticed and the credential server will reject any more attempts (correct or not) to find the password.


For more about Brute Force, the top three links are good reading:
https://en.wikipedia.org/wiki/Brute_force

Hope this helps.

[shadder]

Duoas wrote:

The problem is that it is exceedingly inefficient, and attempts to do it will be noticed and the credential server will reject any more attempts (correct or not) to find the password.

Isn't there any solution?

PS: I am not trying to learn hacking ;) I am just curious

[Duthomhas]

Isn't there any solution?

Look over the person's shoulder while he types in his password.

There are always ways to reduce the number of things you can try.
For example, you can pretty safely assume that most people's passwords will be less than eight or nine characters in length -- aim for the low-hanging fruit.

Next, try stuff you know about a person. For example, if you are looking to hack someone's bank account, try passwords that contain the bank's name. (Yes, people really are that stupid.)

People tend to reuse passwords. Try combinations with previously-known passwords.

Etc.


For any problem, the trick is to reduce the amount of work needed to be done.
A recent example is in this thread about Pythagorean Triples:
http://www.cplusplus.com/forum/beginner/192130/

Both solutions are "brute force".

- However, one solution tries every possible (a,b,c) and is therefore super slow.

- The other solution uses some math to try only (a,b,c)s that are more likely, and is therefore less slow.

When I solved the problem for myself at home, I used some more math to reduce the potential (a,b,c) to only the most probable solutions, and is therefore super fast. (Perhaps I'll go back and post it.)

[Mora Hannover]

Yea I know Bruteforce goes though millions and trillions of combination to find a password! But I never tend to hack online or this stuff! I hate this evil thing so much! But what is mind-blowing that the Our-Mine Hackers hack a twitter everyday! How do they go through all these millions of combinations of passwords at a short time and how they guess a password everyday? BTW, I agree twitter is not good with its security and it really non-sense since the co-founder's account itself was hacked and he did nothing!

[48bpfSEw]

I read these tools are using Network-CPU-Power, wordbooks, rainbow-tables (?) and other algorithms to find faster the passwords.

http://www.chip.de/news/Brute-Force-Programm-Gratis-Download-knackt-Archive_62848723.html


(?) rainbow-tables are simply a list of known passwords, no combination required!