Introduction
If you are new to brute forcing, then this article is great for you. Even if you have a pretty good understanding of brute forcing, this may still be new knowledge for you in some aspects. There have been a couple articles released on brute forcing. One was extremely huge, which would more then likely confuse the end user rather then help them benefit from it. You will notice on my site Global Brute Forcer and FTP Brute Forcer and may have no understand what they mean. You might know what they do, steal passwords, but don’t understand the whole theory and past of brute forcing, so lets get started.
Brute Forcings Past
Now, I am no expert on the past of brute forcing, but I know what it has been used for, even before computers. People were guessing other peoples information long ago. They could be trying various information over and over again until they are on the dot, which would be a brute force method in computer terms. Even a lot of governments agencies and such whose main goal are to decrypt and decipher various coded passwords use brute force methods for one of there approaches. The fact that they probably have super computers to do there dirty work or just really powerful ones in general, it would not take long to decrypt a password, depending on its level of encryption. Using brute force is so powerful, people always say things like “brute force is weak,” as if you are some computer god and can snap your finger and its done. Well, I hate to break it to you, but brute forcing is one of the first methods approached to getting passwords, whether its Windows or Unix/Linux accounts, or a type of service which requires authentication such as FTP, SMB, SMTP, etc. and the best approach would be a brute force attack.
Methods of Brute Force
There are various methods of brute forcing out there. It is not just limited to trying all possible character combinations. A lot of people think that dictionary attacks are not brute forcing. You are wrong, they do not categorize that as a separate attack. The whole idea came from brute force, there for it is held in that category. Think about it, you are loading a list of words, attempting each word as the password to the user account. You would be doing the same thing with all possible char combos. Just going at a faster approach by trying the easily known passwords before really going all out. The method is a time consuming process, depending on how strong the password is you are trying to steal. If you are really true to wanting a password, chances are you could be waiting years to get it. This account would obviously have changed some how over time, if you are ever successful in getting it, which I will not say you ever will be.
Attacking with brute force method over the internet really takes some skills. No, it does not take skill if the password was just something like 1234, it must go beyond this. You must analyze your target and do some research on them. Sometimes, you can end up with being able to guess there passwords or make up your own custom dictionary lists and run them which you created by learning more about the person. In some cases, the password has to do with there username, family, or even pieces from there web site. Other cases the passwords would need an approach of using all possible char combinations. Doing this type of attack online is not really a good idea, considering that it would take years to complete and you are trying so many requests the server would eventually kick you off.
Brute forcing can go beyond just password guessing. You can use brute force for many other goodies. For instance, you want some valid accounts on a server? Simple, use brute force methods to try various usernames over and over again, looking for the correct strings sent back the server to determine if the username is valid. I added this option to Global Brute Force, which if you know how to write a definition file writing additional information to be able to use Account Scanner should not be hard. Maybe you want to discover various folders on peoples web site? Such as Discover does. Use the brute force attack method. Load a dictionary list, start scanning the domains, all sorts of goodies could be popping up all over the place that you never knew about. So, brute forcing is a great method in the security world and is a must to understand.
I will now provide you with some examples of the brute force process, maybe it will help you understand better, maybe not. The format used is that of like using FTP to connect through the URL bar (ftp://username:password@server.com). So, it goes Username : Password.
These examples show the way it works against a server, whether its http, ftp, or even SMB. The same principle can be used against whatever you are using it for. Not just against servers.
Dictionary Attacks
The passwords are reading from the file C:\WordList.txt as shown in the brackets.
Connection to Server => Authentication Login => Sends Required Strings => Username:Sackface(C:\WordList.txt)
Connection to Server => Authentication Login => Sends Required Strings => Username:Sammy(C:\WordList.txt)
Connection to Server => Authentication Login => Sends Required Strings => Username:Susan(C:\WordList.txt)
Connection to Server => Authentication Login => Sends Required Strings => Username:Suicide(C:\WordList.txt)
Servers Response => If Invalid Password => Brute Force loops to next password
Servers Response => If Valid Password => Brute Force method stops, and logs found passwords.
All Possible Character Combinations
This method works about the same, just uses all possible character combos.
Connection to Server => Authentication Login => Sends Required Strings => Username:aaaa
Connection to Server => Authentication Login => Sends Required Strings => Username:aaab
Connection to Server => Authentication Login => Sends Required Strings => Username:aaac
Connection to Server => Authentication Login => Sends Required Strings => Username:aaad
Servers Response => If Invalid Password => Brute Force loops to next password
Servers Response => If Valid Password => Brute Force method stops, and logs found passwords.
It will continuously try all possible character combinations for the password, as seen, trying all possible character combos for aaaa, which would take quite a long time to generate all of them, considering every possible character, including ASCII chars.
How Can I protect myself or my servers from this?
There are a few methods that you could go about protection yourself and your servers. Use long passwords, in the twenties or teens, including no words, just numbers, letters and ASCII chars. This will be one of the hardest passwords to guess, considering it would take years to come to such a lengthy password and have to generate all of those characters. Also, never give your real e-mail address that you register accounts with on your site, this could prove to be useful for others to enumerate information about you. Now, if you are hosting a server and you are afraid of brute force attacks being used against your servers, there are some things you can do to stop it. I would recommend using an account block method. If someone is trying to guess over and over the password, simply have the account disable itself, so that no matter what IP address hits the accounts, it will be locked for your protection. If you are experiencing just brute force attacks from one certain IP address then create a banning system. If a user from a specific IP address is attempting hundreds of passwords to a certain account or even thousands, have it completely ban there IP address. You can either ban them for good, or just for a day or two. A good way to stop brute forcers is to use some type of encrypted login, such as HTTPS which would just show encrypted text back when a user tries to login and sniff the data to create a brute force attack with. Sometimes using a persons E-Mail address as the login can prove more affective since they are so much harder to “guess” then a simple username such as Administrator anything of that nature. I have seen logins that even once you have the password to the account, it will give you steps before actually entering, maybe asking for your secret questions or even a social security number. This proves to be very affective also. NEVER use passwords that relate to your phone number, CC, SSN, or anything of that type. That should help you prevent most brute forcers from being unsuccessful.
Conclusion
This may have been a smaller article, but it gets down to the point of brute forcing. You should have a solid understanding of how it works, what its used for and more. If anyone was to ask any suggestions for brute forcing, I would simply tell them to know there target. At least take time to enumerate information and do some social engineering that could possibly lead to his password. If you wish, you can jump right in and start attacking with brute force methods. Just remember, that could be time consuming, but then again, either way could end you up in the dumps! Just please, before you go dissing on brute force, realize how important it is for security assessment scanning. If you could of not figured this out for yourself of how important it is, I really hope you are a newbie or just learning.
If you are new to brute forcing, then this article is great for you. Even if you have a pretty good understanding of brute forcing, this may still be new knowledge for you in some aspects. There have been a couple articles released on brute forcing. One was extremely huge, which would more then likely confuse the end user rather then help them benefit from it. You will notice on my site Global Brute Forcer and FTP Brute Forcer and may have no understand what they mean. You might know what they do, steal passwords, but don’t understand the whole theory and past of brute forcing, so lets get started.
Brute Forcings Past
Now, I am no expert on the past of brute forcing, but I know what it has been used for, even before computers. People were guessing other peoples information long ago. They could be trying various information over and over again until they are on the dot, which would be a brute force method in computer terms. Even a lot of governments agencies and such whose main goal are to decrypt and decipher various coded passwords use brute force methods for one of there approaches. The fact that they probably have super computers to do there dirty work or just really powerful ones in general, it would not take long to decrypt a password, depending on its level of encryption. Using brute force is so powerful, people always say things like “brute force is weak,” as if you are some computer god and can snap your finger and its done. Well, I hate to break it to you, but brute forcing is one of the first methods approached to getting passwords, whether its Windows or Unix/Linux accounts, or a type of service which requires authentication such as FTP, SMB, SMTP, etc. and the best approach would be a brute force attack.
Methods of Brute Force
There are various methods of brute forcing out there. It is not just limited to trying all possible character combinations. A lot of people think that dictionary attacks are not brute forcing. You are wrong, they do not categorize that as a separate attack. The whole idea came from brute force, there for it is held in that category. Think about it, you are loading a list of words, attempting each word as the password to the user account. You would be doing the same thing with all possible char combos. Just going at a faster approach by trying the easily known passwords before really going all out. The method is a time consuming process, depending on how strong the password is you are trying to steal. If you are really true to wanting a password, chances are you could be waiting years to get it. This account would obviously have changed some how over time, if you are ever successful in getting it, which I will not say you ever will be.
Attacking with brute force method over the internet really takes some skills. No, it does not take skill if the password was just something like 1234, it must go beyond this. You must analyze your target and do some research on them. Sometimes, you can end up with being able to guess there passwords or make up your own custom dictionary lists and run them which you created by learning more about the person. In some cases, the password has to do with there username, family, or even pieces from there web site. Other cases the passwords would need an approach of using all possible char combinations. Doing this type of attack online is not really a good idea, considering that it would take years to complete and you are trying so many requests the server would eventually kick you off.
Brute forcing can go beyond just password guessing. You can use brute force for many other goodies. For instance, you want some valid accounts on a server? Simple, use brute force methods to try various usernames over and over again, looking for the correct strings sent back the server to determine if the username is valid. I added this option to Global Brute Force, which if you know how to write a definition file writing additional information to be able to use Account Scanner should not be hard. Maybe you want to discover various folders on peoples web site? Such as Discover does. Use the brute force attack method. Load a dictionary list, start scanning the domains, all sorts of goodies could be popping up all over the place that you never knew about. So, brute forcing is a great method in the security world and is a must to understand.
I will now provide you with some examples of the brute force process, maybe it will help you understand better, maybe not. The format used is that of like using FTP to connect through the URL bar (ftp://username:password@server.com). So, it goes Username : Password.
These examples show the way it works against a server, whether its http, ftp, or even SMB. The same principle can be used against whatever you are using it for. Not just against servers.
Dictionary Attacks
The passwords are reading from the file C:\WordList.txt as shown in the brackets.
Connection to Server => Authentication Login => Sends Required Strings => Username:Sackface(C:\WordList.txt)
Connection to Server => Authentication Login => Sends Required Strings => Username:Sammy(C:\WordList.txt)
Connection to Server => Authentication Login => Sends Required Strings => Username:Susan(C:\WordList.txt)
Connection to Server => Authentication Login => Sends Required Strings => Username:Suicide(C:\WordList.txt)
Servers Response => If Invalid Password => Brute Force loops to next password
Servers Response => If Valid Password => Brute Force method stops, and logs found passwords.
All Possible Character Combinations
This method works about the same, just uses all possible character combos.
Connection to Server => Authentication Login => Sends Required Strings => Username:aaaa
Connection to Server => Authentication Login => Sends Required Strings => Username:aaab
Connection to Server => Authentication Login => Sends Required Strings => Username:aaac
Connection to Server => Authentication Login => Sends Required Strings => Username:aaad
Servers Response => If Invalid Password => Brute Force loops to next password
Servers Response => If Valid Password => Brute Force method stops, and logs found passwords.
It will continuously try all possible character combinations for the password, as seen, trying all possible character combos for aaaa, which would take quite a long time to generate all of them, considering every possible character, including ASCII chars.
How Can I protect myself or my servers from this?
There are a few methods that you could go about protection yourself and your servers. Use long passwords, in the twenties or teens, including no words, just numbers, letters and ASCII chars. This will be one of the hardest passwords to guess, considering it would take years to come to such a lengthy password and have to generate all of those characters. Also, never give your real e-mail address that you register accounts with on your site, this could prove to be useful for others to enumerate information about you. Now, if you are hosting a server and you are afraid of brute force attacks being used against your servers, there are some things you can do to stop it. I would recommend using an account block method. If someone is trying to guess over and over the password, simply have the account disable itself, so that no matter what IP address hits the accounts, it will be locked for your protection. If you are experiencing just brute force attacks from one certain IP address then create a banning system. If a user from a specific IP address is attempting hundreds of passwords to a certain account or even thousands, have it completely ban there IP address. You can either ban them for good, or just for a day or two. A good way to stop brute forcers is to use some type of encrypted login, such as HTTPS which would just show encrypted text back when a user tries to login and sniff the data to create a brute force attack with. Sometimes using a persons E-Mail address as the login can prove more affective since they are so much harder to “guess” then a simple username such as Administrator anything of that nature. I have seen logins that even once you have the password to the account, it will give you steps before actually entering, maybe asking for your secret questions or even a social security number. This proves to be very affective also. NEVER use passwords that relate to your phone number, CC, SSN, or anything of that type. That should help you prevent most brute forcers from being unsuccessful.
Conclusion
This may have been a smaller article, but it gets down to the point of brute forcing. You should have a solid understanding of how it works, what its used for and more. If anyone was to ask any suggestions for brute forcing, I would simply tell them to know there target. At least take time to enumerate information and do some social engineering that could possibly lead to his password. If you wish, you can jump right in and start attacking with brute force methods. Just remember, that could be time consuming, but then again, either way could end you up in the dumps! Just please, before you go dissing on brute force, realize how important it is for security assessment scanning. If you could of not figured this out for yourself of how important it is, I really hope you are a newbie or just learning.
Good Guide.
ReplyDelete