Attacks on suspected militias are still one of the most popular ways to crack passwords. However, it is not just a password crack. Brute Attack can be used to find hidden pages and content in a web application. This attack is actually a “hit and try” until you succeed. These attacks sometimes take a long time, but the success rate is high.
In this article, I will try to explain the brutal attacks of popular tools and tools used in various situations to make powerful attacks to get the results you want.
What is a brute force attack?
Contents
A brute force attack when an attacker uses a set of predefined values to attack a target and analyze the response until he succeeds. Success depends on the set of predefined values. If it is larger, it will take more time, but there is a better probability of success.
The most common and easiest to understand example of the brute force attack is the dictionary attack to crack passwords. In this, the attacker uses a password dictionary that contains millions of words that can be used as a password. The attacker tries these passwords one by one for authentication. If this dictionary contains the correct password, the attacker will succeed.
In a traditional brute force attack, the attacker just tries the combination of letters and numbers to generate a password sequentially. However, this traditional technique will take longer when the password is long enough. These attacks can take several minutes to several hours or several years, depending on the system used and length of password.
To prevent password cracking from brute force attacks, one should always use long and complex passwords. This makes it hard for attackers to guess the password, and brute force attacks will take too much time. Account lockout is another way to prevent the attacker from performing brute force attacks on web applications. However, for offline software, things are not as easy to secure.
Similarly, for discovering hidden pages, the attacker tries to guess the name of the page, sends requests and sees the response. If the page does not exist, it will show a 404 response; on a success, the response will be 200. In this way, it can find hidden pages on any website.
Brute force is also used to crack the hash and guess a password from a given hash. In this, the hash is generated from random passwords and then this hash is matched with a target hash until the attacker finds the correct one. Therefore, the higher the type of encryption (64-bit, 128-bit or 256-bit encryption) used to encrypt the password, the longer it can take to break.
Reverse brute force attack
A reverse brute force attack is another term that is associated with password cracking. It takes a reverse approach in password cracking. In this, the attacker tries one password against multiple usernames. Imagine if you know a password but do not have any idea of the usernames. In this case, you can try the same password and guess the different usernames until you find the working combination.
Now, you know that a brute-forcing attack is mainly used for password cracking. You can use it in any software, any website or any protocol which does not block requests after a few invalid trials. In this post, I am going to add a few brute force password-cracking tools for different protocols.
Popular tools for brute force attacks
Aircrack-ng
I am sure you already know about the Aircrack-ng tool. This is a popular brute force wifi password cracking tool available for free. I also mentioned this tool in our older post on most popular password-cracking tools. This tool comes with WEP/WPA/WPA2-PSK cracker and analysis tools to perform attacks on Wi-Fi 802.11. Aircrack-ng can be used for any NIC which supports raw monitoring mode.
It basically performs dictionary attacks against a wireless network to guess the password. As you already know, the success of the attack depends on the dictionary of passwords. The better and more effective the password dictionary is, the more likely it is that it will crack the password.
It is available for Windows and Linux platforms. It has also been ported to run on iOS and Android platforms. You can try it on given platforms to see how this tool can be used for brute force wifi password cracking.
Download Aircrack-ng here.
John the Ripper
John the Ripper is another awesome tool that does not need any introduction. It has been a favorite choice for performing brute force attacks for a long time. This free password-cracking software was initially developed for Unix systems. Later, developers released it for various other platforms. Now, it supports fifteen different platforms including Unix, Windows, DOS, BeOS and OpenVMS.
You can use this either to identify weak passwords or to crack passwords for breaking authentication.
This tool is very popular and combines various password-cracking features. It can automatically detect the type of hashing used in a password. Therefore, you can also run it against encrypted password storage.
Basically, it can perform brute force attacks with all possible passwords by combining text and numbers. However, you can also use it with a dictionary of passwords to perform dictionary attacks.
Download John the Ripper here.
Rainbow Crack
Rainbow Crack is also a popular brute-forcing tool used for password cracking. It generates rainbow tables for using while performing the attack. In this way, it is different from other conventional brute-forcing tools. Rainbow tables are pre-computed. It helps in reducing the time in performing the attack.
The good thing is that there are various organizations which have already published the pre-computer rainbow tables for all internet users. To save time, you can download those rainbow tables and use them in your attacks.
This tool is still in active development. It is available for both Windows and Linux and supports all latest versions of these platforms.
Download Rainbow Crack and read more about this tool here.
L0phtCrack
L0phtCrack is known for its ability to crack Windows passwords. It uses dictionary attacks, brute force attacks, hybrid attacks and rainbow tables. The most notable features of L0phtcrack are scheduling, hash extraction from 64-bit Windows versions, multiprocessor algorithms and network monitoring and decoding. If you want to crack the password of a Windows system, you can try this tool.
Download L0phtCrack here.
Ophcrack
Ophcrack is another brute-forcing tool specially used for cracking Windows passwords. It cracks Windows passwords by using LM hashes through rainbow tables. It is a free and open-source tool.
In most cases, it can crack a Windows password in a few minutes. By default, Ophcrack comes with rainbow tables to crack passwords of less than 14 characters which contain only alphanumeric characters. Other rainbow tables are also available to download.
Ophcrack is also available as LiveCD.
Download Ophcrack here.
Hashcat
Hashcat claims to be the fastest CPU-based password cracking tool. It is free and comes for Linux, Windows and Mac OS platforms. Hashcat supports various hashing algorithms including LM Hashes, MD4, MD5, SHA-family, Unix Crypt formats, MySQL and Cisco PIX. It supports various attacks including brute force attacks, combinator attacks, dictionary attacks, fingerprint attacks, hybrid attacks, mask attacks, permutation attack, rule-based attacks, table-lookup attacks and toggle-case attacks.
Download Hashcat here.
DaveGrohl
DaveGrohl is a popular brute-forcing tool for Mac OS X. It supports all available versions of Mac OS X. This tool supports both dictionary attacks and incremental attacks. It also has a distributed mode that lets you perform attacks from multiple computers to attack on the same password hash.
This tool is now open-source and you can download the source code.
Download DaveGrohl here.
Ncrack
Ncrack is also a popular password-cracking tool for cracking network authentications. It supports various protocols including RDP, SSH, HTTP(S), SMB, POP3(S), VNC, FTP and Telnet. It can perform different attacks including brute-forcing attacks. It supports various platforms including Linux, BSD, Windows and Mac OS X.
Download Ncrack here.
THC Hydra
THC Hydra is known for its ability to crack passwords of network authentications by performing brute force attacks. It performs dictionary attacks against more than 30 protocols including Telnet, FTP, HTTP, HTTPS, SMB and more. It is available for various platforms including Linux, Windows/Cygwin, Solaris 11, FreeBSD 8.1, OpenBSD, OSX and QNX/Blackberry.
Download THC Hydra here
