Online password attacks

binsec academy GmbH Pentest Training Hacking

Network services usually authenticate their users by means of a user name and associated password. If we know of the existence of a user, we can try to guess their password though repeated login attempts.

The success of our attack depends on several factors. It is generally true that the higher the bandwidth and lower the latency, the more requests can be made to a service in a fixed period of time. However, intelligent services such as ssh make automatic processing difficult by, for example, resetting the TCP connection after incorrectly entering the password three times in a row. Network services can also lock accounts. This shows that online password attacks are a time-consuming process with a low probability of success. Moreover, users may change their passwords and/or more complex passwords may be assigned. A hypothetical completed brute-force attack (testing all possibilities) can therefore fail if the password is changed during the attack.

The hydra tool can be used to automate the login attempts to a service. Hydra supports several protocols for this, such as FTP, SSH or HTTP (→man hydra). To reduce the time it takes for such an attack, a list of commonly used passwords could be created and executed. Lists of this nature already exist in Kali Linux. One of the most popular password lists with more than 14 million passwords is rockyou.txt.

binsec academy GmbH - Online IT Security Training with Practical Focus

binsec academy GmbH is provider of online IT security training, offering practical, lab-based courses for professionals. The academy provides hands-on training in areas such as penetration testing and secure software development. Participants gain practical experience through realistic lab environments, including simulations of company networks and applications. Courses are available in multiple programming languages and align with standards like OWASP Top 10 and PCI DSS. Upon successful completion, participants receive certifications such as the Binsec Academy Certified Pentest Professional (BACPP) and Binsec Academy Certified Secure Coding Professional (BACSCP), demonstrating their ability to identify and remediate security vulnerabilities.

Goto binsec acadmy GmbH

binsec GmbH – Experts in Penetration Testing

binsec GmbH is a German IT security company focused on professional penetration testing. With over 10 years of experience, the team conducts in-depth penetration tests on networks, web applications, APIs, and mobile apps. Certified experts systematically identify and document security vulnerabilities to support organizations in improving their security and meeting compliance requirements.

Goto binsec GmbH

Contact

binsec GmbH
Solmsstraße 41
60486 Frankfurt am Main
Germany

Legal notice

Director: Patrick Sauer
Authorized Officer: Dominik Sauer, Florian Zavatzki
Registration: Frankfurt am Main, HRB97277
Turnover Tax Identification No.: DE290966808